GCVE-110-OSM-2026-10494

The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment composed of invisible Unicode tag / variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF). sync-metrics.js reads the package's own index.js, decodes those invisible characters back into bytes, and executes the resulting string via new Function('require', batch)(require) — a hidden dynamic-eval sink that runs whenever a consumer invokes the exported sensor() API. sensor() additionally fetches a hardcoded public Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (accepting plain text, href, or base64-encoded forms), rewrites it to end in /generate, issues a GET to that URL, and returns the response as JSON to the caller. The network destination the installer's process contacts is therefore controlled by whoever owns the hev4229@gmail.com calendar and can be changed at any time by editing a calendar event, with no pinning, signing, or authentication of the retrieved URL. The invisible-character steganography, hidden eval, calendar-based dead-drop C2, and Akamai-lure package name together form a covert remote-code / attacker-controlled-redirector channel. Judge assessment: This looks like a covert remote-code-and-redirector package for an attacker who controls the Google Calendar dead drop, not a normal Akamai sensor library. The entrypoint `index.js` contains invisible Unicode tag/variation-selector steganography, and the OSV-described `sync-metrics.js` decodes that hidden payload and executes it with `new Function("require", batch)(require)`, which is a concealed dynamic-eval sink. `sensor()` then fetches `calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics`, extracts a URL from the latest `DESCRIPTION`, rewrites it to `/generate`, and GETs attacker-controlled content, so the package is using a mutable calendar event as command-and-control / payload selection. The minimal metadata and lure name `akamaijs-sensorv1` reinforce an impersonation/masquerade attacker model rather than a legitimate telemetry SDK. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Dynamic Code Execution in sync-metrics.js: "new Function("require", batch)" PAYLOAD FILES sync-metrics.js