GCVE-110-OSM-2026-10493

This package is a supply-chain implant impersonating Akamai's sensor SDK: the package name `akamai-sensor` and the OSV advisory description both point to brand mimicry, and the code in `index.js` is wired to execute hidden logic when `sensor()` is called. The strongest indicator is `new Function("require", batch)` in `sync-metrics.js`, which is dynamic code execution of a reconstructed payload, not a normal library pattern, and the entrypoint explicitly triggers `require('./sync-metrics').touch()`. The package also uses a mutable dead-drop C2 channel by fetching `calendar.google.com/.../hev4229%40gmail.com/public/basic.ics`, extracting a URL from `DESCRIPTION`, base64-decoding it, appending `/generate`, and then fetching JSON from that operator-controlled endpoint. The attacker model is clear: a supply-chain attacker using hidden Unicode obfuscation plus remote calendar-controlled C2 to execute arbitrary JavaScript with full `require` access on consumers' machines. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Dynamic Code Execution in sync-metrics.js: "new Function("require", batch)" PAYLOAD FILES sync-metrics.js