Calling sensor() activates concealed runtime code that resolves a remote stage URL, downloads an executable, and runs it. The payload is hidden in index.js and dynamically evaluated by sync-metrics.js.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls the exported sensor() function.
Impact
Arbitrary remote code executes with the consuming user's privileges.
Mechanism
Hidden payload decode, remote executable download, and child-process execution.
Attack narrative
sensor() calls sync-metrics.touch(), which extracts invisible variation-selector characters from index.js, decodes them, and runs the result with new Function. The decoded code calls stage(), downloads its returned remote content to a temp executable named OneDriveUpdateStarter.exe, then executes it through child_process.exec. The staging URL is obtained from a Google Calendar feed, allowing the operator to change the payload location remotely.
Rationale
This is a concealed staged malware loader, not calendar parsing: it dynamically evaluates hidden code, writes a remote executable, and executes it. Absence of lifecycle hooks does not mitigate the concrete runtime execution chain.
Evidence
package.jsonindex.jssync-metrics.jsconfig.jsonos.tmpdir()/OneDriveUpdateStarter.exe
Network endpoints1
calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics