Malicious NPM package uses Unicode steganography to evade detection

A malicious NPM package, os-info-checker-es6, was updated to include obfuscated install scripts and a sophisticated C2 that hides data using invisible Unicode variation selectors and retrieves a base64-encoded stage-2 payload via Google Calendar links; the package (and several dependent packages) has been downloaded over 1,000 times, includes persistence and eval-based execution, and remains listed on the NPM registry despite disclosure to maintainers and prior reporting by other researchers.