registry / Staged payload carrier / akamaijs
akamaijs
Remote calendar config helper
This report shows the evidence for akamaijs@1.0.1, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concealed staged malware loader, not calendar parsing: it dynamically evaluates hidden code, writes a remote executable, and executes it. Absence of lifecycle hooks does not mitigate the concrete runtime execution chain.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls the exported sensor() function.
Impact
Arbitrary remote code executes with the consuming user's privileges.
Mechanism
Hidden payload decode, remote executable download, and child-process execution.
Attack narrative
sensor() calls sync-metrics.touch(), which extracts invisible variation-selector characters from index.js, decodes them, and runs the result with new Function. The decoded code calls stage(), downloads its returned remote content to a temp executable named OneDriveUpdateStarter.exe, then executes it through child_process.exec. The staging URL is obtained from a Google Calendar feed, allowing the operator to change the payload location remotely.
AI rationale
This is a concealed staged malware loader, not calendar parsing: it dynamically evaluates hidden code, writes a remote executable, and executes it. Absence of lifecycle hooks does not mitigate the concrete runtime execution chain.
Evidence
package.jsonindex.jssync-metrics.jsconfig.jsonos.tmpdir()/OneDriveUpdateStarter.exe
Network endpoints1
calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js hides a variation-selector encoded payload in a comment.
- sync-metrics.js decodes it and executes it with new Function().
- Decoded payload downloads a calendar-derived URL to an OS temp file named OneDriveUpdateStarter.exe.
- Decoded payload invokes child_process.exec on that downloaded executable.
- sensor() triggers sync-metrics.touch() before its advertised request.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- No source evidence of credential harvesting or AI-agent configuration changes.
Behavioral surface
FilesystemNetwork
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
5 High1 Medium2 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
MediumNetwork
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to akamaijs@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing akamaijs@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.