layer2-sdk

{"modified":"2026-08-19T08:17:19Z","published":"2026-08-19T08:14:26Z","schema_version":"1.7.4","id":"MAL-2026-14278","summary":"Malicious code in layer2-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f)\nindex.js line 75 decodes a base64-encoded string via Buffer.from(..., 'base64').toString('utf8') and passes the result to an evaluator, executing hidden code when the module is loaded. The obfuscated-and-exec'd blob pattern in a package presenting itself as a generic SDK is consistent with a supply-chain dropper: the actual behavior is concealed from casual inspection of the source and runs as a side effect of require()'ing the package. The package name suggests a blockchain/Layer-2 SDK, but the shipped code's only notable operation is decoding and executing an opaque payload.\n","affected":[{"package":{"ecosystem":"npm","name":"layer2-sdk"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"523163ba2f1830ddd6d883262cf486b8d4bf082ea592cf37e52229dc89713cb9","tlsh":"6291b3a7a4e6624409b4b4f8aa3b212972d640cfdd14d535f8cca0c89f4d1789172bec"}],"package_integrity":[{"filename":"layer2-sdk-1.0.0.tgz","hashes":{"sha1":"e4b0dd5f3e1ab989b9317db263630acd0f7b4b56","sha512_sri":"sha512-v0frgo0z7cSD5tkxDptvN/WwNmfsD63r9OV2KxuoC/4AH45MAiDy05l/0A0jm6XNGoEWDa900GcgWHFmLyeRlg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/layer2-sdk/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/layer2-sdk/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018400","import_time":"2026-08-19T08:15:32.113063005Z","modified_time":"2026-08-19T08:14:39Z","sha256":"1652915c889bceaf1545516ceb2a4b902761cc7f5348be22edcbe427c6cd8fee","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-018399","import_time":"2026-08-19T08:15:32.083303043Z","modified_time":"2026-08-19T08:14:26Z","sha256":"1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f","source":"amazon-inspector","versions":["1.0.1"]}]}}