---
id: 2520
title: "You're Invited: Delivering malware via Google Calendar invites and PUAs"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/youre-invited-delivering-malware-via-google-calendar-invites-and-puas"
published_at: "2025-05-13 00:00"
tags: ["supply-chain", "malware", "npm", "obfuscation", "aikido", "malware-analysis", "eval", "package-security", "unicode", "aikido-intel", "npm-malware", "unicode-pua", "google-calendar"]
phying_url: "https://phying.com/item/2520"
lang: en
---

# You're Invited: Delivering malware via Google Calendar invites and PUAs

## Summary

Aikido found npm package os-info-checker-es6 hiding malicious logic behind Unicode Private Use Area characters, decoded by a native binary into base64 for eval() to execute, evading code review.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2025-05-13 00:00
- **Original:** https://www.aikido.dev/blog/youre-invited-delivering-malware-via-google-calendar-invites-and-puas
- **Phying News:** https://phying.com/item/2520