Which versions of akamaijs-sensorv1 are malicious?

The following npm versions of akamaijs-sensorv1 are flagged malicious: 3.0.0. Treat any of these as compromised.

How do I remediate akamaijs-sensorv1 if I installed it?

akamaijs-sensorv1 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed akamaijs-sensorv1 — how do I know if it already compromised me?

If akamaijs-sensorv1 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is akamaijs-sensorv1 part of a known attack campaign?

Yes — akamaijs-sensorv1 is associated with the IN-MAL-2026-017972 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find akamaijs-sensorv1 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for akamaijs-sensorv1 (version 3.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging akamaijs-sensorv1 across your stack and pipelines.

Malicious package

akamaijs-sensorv1npm

akamaijs-sensorv1 is a confirmed malicious npm package (MAL-2026-14066) that opens a backdoor for remote access (malicious version 3.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in akamaijs-sensorv1 (npm)

MAL-2026-14066

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall akamaijs-sensorv1

What this malware does

The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment composed of invisible Unicode tag / variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF). sync-metrics.js reads the package's own index.js, decodes those invisible characters back into bytes, and executes the resulting string via new Function('require', batch)(require) — a hidden dynamic-eval sink that runs whenever a consumer invokes the exported sensor() API. sensor() additionally fetches a hardcoded public Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (accepting plain text, href, or base64-encoded forms), rewrites it to end in /generate, issues a GET to that URL, and returns the response as JSON to the caller. The network destination the installer's process contacts is therefore controlled by whoever owns the [email protected] calendar and can be changed at any time by editing a calendar event, with no pinning, signing, or authentication of the retrieved URL. The invisible-character steganography, hidden eval, calendar-based dead-drop C2, and Akamai-lure package name together form a covert remote-code / attacker-controlled-redirector channel.

Malicious versions

1 flagged

3.0.0

Indicators of compromise (SHA-256)

9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267

Detection & response playbook

Backdoor / remote access

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for akamaijs-sensorv1 (version 3.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging akamaijs-sensorv1 across your stack and pipelines.
If you installed it — respond
akamaijs-sensorv1 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If akamaijs-sensorv1 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks akamaijs-sensorv1 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. akamaijs-sensorv1 on npm has been identified as a malicious package (version 3.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017972

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks akamaijs-sensorv1-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database