If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2)
The package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling the exported sensor() triggers sync-metrics.touch(), which reads a comment in index.js whose body is not ASCII but a long run of Unicode variation-selector codepoints (U+FE00-FE0F, U+E0100-E01EF). An unpack() routine maps those invisible codepoints back to bytes, producing a JavaScript payload that is then executed via new Function('require', batch)(require) — giving the decoded code full require access to child_process, http, fs, os, and path. The decoded payload contacts a hardcoded C2 at http://souichidomain1870.xyz:5000/packageStarter. In parallel, fromCalendar() fetches a hardcoded public Google Calendar ICS feed owned by hev4229@gmail.com, scans DESCRIPTION lines for a URL (plain or base64-encoded), appends /generate, and returns JSON from that endpoint to callers — an attacker-mutable dead-drop for changing the runtime target without republishing the package. The invisible-character source comment, dynamic new Function evaluation, calendar-based endpoint resolution, and akamai-branded cover story together constitute a hidden remote-control implant, not a sensor-generation utility.