{"id":"MAL-2026-14278","summary":"Malicious code in layer2-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f)\nindex.js line 75 decodes a base64-encoded string via Buffer.from(..., 'base64').toString('utf8') and passes the result to an evaluator, executing hidden code when the module is loaded. The obfuscated-and-exec'd blob pattern in a package presenting itself as a generic SDK is consistent with a supply-chain dropper: the actual behavior is concealed from casual inspection of the source and runs as a side effect of require()'ing the package. The package name suggests a blockchain/Layer-2 SDK, but the shipped code's only notable operation is decoding and executing an opaque payload.\n","modified":"2026-08-19T08:32:48.266685805Z","published":"2026-08-19T08:14:26Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-19T08:15:32.113063005Z","modified_time":"2026-08-19T08:14:39Z","sha256":"1652915c889bceaf1545516ceb2a4b902761cc7f5348be22edcbe427c6cd8fee","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018400"},{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-018399","import_time":"2026-08-19T08:15:32.083303043Z","modified_time":"2026-08-19T08:14:26Z","sha256":"1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/layer2-sdk/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/layer2-sdk/v/1.0.1"}],"affected":[{"package":{"name":"layer2-sdk","ecosystem":"npm","purl":"pkg:npm/layer2-sdk"},"versions":["1.0.0","1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/layer2-sdk/MAL-2026-14278.json","indicators":{"evidence_files":[{"sha256":"523163ba2f1830ddd6d883262cf486b8d4bf082ea592cf37e52229dc89713cb9","tlsh":"6291b3a7a4e6624409b4b4f8aa3b212972d640cfdd14d535f8cca0c89f4d1789172bec","path":"index.js"}],"package_integrity":[{"filename":"layer2-sdk-1.0.0.tgz","hashes":{"sha1":"e4b0dd5f3e1ab989b9317db263630acd0f7b4b56","sha512_sri":"sha512-v0frgo0z7cSD5tkxDptvN/WwNmfsD63r9OV2KxuoC/4AH45MAiDy05l/0A0jm6XNGoEWDa900GcgWHFmLyeRlg=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}