Researchers have uncovered a sophisticated malware campaign involving a malicious npm package named “os-info-checker-es6”, which poses as a system utility but stealthily delivers a multi-stage payload using advanced obfuscation and command-and-control (C2) evasion techniques. First published on March 19, 2025, the package was initially benign but evolved significantly by May 7, with version 1.0.8 introducing Unicode-based steganography to hide a C2 mechanism that leverages Google Calendar short links as dead drop resolvers. The malicious code uses invisible Unicode Variation Selectors to conceal base64-encoded URLs, which are extracted from Google Calendar event metadata, decoded, and executed via eval(), potentially with encrypted payloads using HTTP headers for keys. The package also includes a simple persistence mechanism to avoid multiple instances. Additionally, it is listed as a dependency in four (4) other suspicious packages (skip-tot, vue-dev-serverr, vue-dummyy, and vue-bit0 which masquerade as development tools. Although the final payload was not retrievable during analysis, suggesting the campaign may be dormant or selectively active, the continued availability of these packages on npm highlights the persistent risk posed by software supply chain attacks. CTIX analysts will continue to report on the latest malware strains and attacker tactics, techniques, and procedures (TTPs).