Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

A newly discovered malicious npm package, os-info-checker-es6, masquerades as a utility for retrieving OS information but is designed to stealthily deliver a next-stage payload.