Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in layer2-sdk (npm)

The npm package layer2-sdk contained malicious code that decoded and executed a hidden payload on module load. The package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on adoption of malicious versions
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • layer2-sdknpm package containing obfuscated malicious code

The npm package layer2-sdk was found to contain malicious code in its index.js file at line 75. The code decodes a base64-encoded string using Buffer.from(..., 'base64').toString('utf8') and passes the result to an evaluator, executing hidden code as a side effect of requiring the package.\n\nThe package presented itself as a generic blockchain/Layer-2 SDK, but the actual shipped code's primary operation was decoding and executing an opaque payload. This pattern—obfuscated code that executes on module load—is consistent with a supply-chain dropper designed to conceal its true behavior from casual source inspection.\n\nThe malicious package was identified by Amazon Inspector and reported through the OpenSSF malicious-packages repository (MAL-2026-14278).

Indicators of compromise

Packages
  • layer2-sdk

Remediation

  • Remove layer2-sdk from all dependencies immediately
  • Audit all systems where layer2-sdk was installed for signs of compromise
  • Review npm audit logs for installation of layer2-sdk
  • Use npm to identify and remove the package from node_modules and package-lock.json
  • Consider rotating credentials and secrets on affected systems
  • Monitor for any suspicious activity or data exfiltration from systems that had layer2-sdk installed

Sources

  1. GitHub Advisory GHSA-wvvm-5h3m-prf6 · GitHub Advisory Database

Cite this entry

"Malicious code in layer2-sdk (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-layer2-sdk-npm-17cvhx

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package