akamai-sensorv1@1.0.0

Analysis

Combosquat package impersonating Akamai. Contains a multi-stage C2 implant: (1) A hidden payload is steganographically encoded using Unicode variation selectors inside a comment in index.js; sync-metrics.js decodes and executes it via dynamic code evaluation. (2) The visible code fetches a Google Calendar ICS feed (calendar[.]google[.]com/calendar/ical/[account]/public/basic.ics), extracts a URL from the DESCRIPTION field of calendar events, appends /generate, and fetches JSON from that URL — a dead-drop C2 channel where the attacker controls the calendar to dynamically change the command server. At runtime the package performed a DNS sandbox-evasion check before executing its payload. No repository URL provided.