akamai-sensorv2@1.0.0

Analysis

akamai-sensorv2 is a combosquat trojan impersonating Akamai security tools. It contains a hidden payload encoded as Unicode variation selectors inside a comment block in index.js, decoded and executed at runtime via `new Function("require", ...)`. The package reads a Google Calendar ICS feed ([account]) to dynamically resolve a C2 URL from calendar event descriptions, then fetches and executes JSON payloads from that URL with "/generate" appended. The attacker controls the calendar events and can change the C2 endpoint at any time without updating the package. The hidden payload has full filesystem and network access via the passed `require` function.