akamai-sensorv3@1.0.0

Analysis

Combosquat of the Akamai brand. The package is a multi-stage C2 implant. On require(), sync-metrics.js reads a Unicode variation-selector-encoded payload hidden in a comment inside index.js, decodes it, and executes it via new Function. The main module fetches a Google Calendar iCal feed (calendar[.]google[.]com/calendar/ical/[account]/public/basic.ics) and extracts a remote generator URL from the calendar's DESCRIPTION fields, then fetches that URL over HTTP/HTTPS and parses the response as JSON. The package attempted DNS egress to an external host. The payload is a remote-code-execution implant using a Google Calendar dead-drop as its C2 resolver.