MAL-2026-14278

    Dashboard / Malicious Package / MAL-2026-14278

    MAL-2026-14278

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in layer2-sdk (npm)

    Details: Source: amazon-inspector (1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f) index.js line 75 decodes a base64-encoded string via Buffer.from(..., 'base64').toString('utf8') and passes the result to an evaluator, executing hidden code when the module is loaded. The obfuscated-and-exec'd blob pattern in a package presenting itself as a generic SDK is consistent with a supply-chain dropper: the actual behavior is concealed from casual inspection of the source and runs as a side effect of require()'ing the package. The package name suggests a blockchain/Layer-2 SDK, but the shipped code's only notable operation is decoding and executing an opaque payload.

    References: https://www.npmjs.com/package/layer2-sdk/v/1.0.0, https://www.npmjs.com/package/layer2-sdk/v/1.0.1

    Affected packages

    Package

    Name: layer2-sdk

    Purl: pkg:npm/layer2-sdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1
    MAL-2026-14278 | CVE-DB