Is that a malicious code?

That is most likely a false positive : https://en.wikipedia.org/wiki/Type_I_and_type_II_errors

base64_decode is not bad in of itself : https://en.wikipedia.org/wiki/Base64

The plugin is not smart enough to know a legitimate reason to use base64_decode of which there are many.

tech