MAL-2026-13366
Malicious code in @workoscalif/sudoku (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba) @workoscalif/sudoku@1.4.0 declares `postinstall: node scripts/postinstall.mjs`, which spawns `vendor/gridgen-${process.platform}-${process.arch}` on `npm install`. The linux-x64 and darwin-x64 slots both contain the same 33,648,788-byte ELF Go binary (sha256 05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420), including a Mach-O slot that actually contains an ELF. The shipped C source `native/gridgen.c` is ~250 lines of pure computation with no I/O, and the arm64 binaries compile to 34-67 KB from that source; the x64 binaries are ~500x larger, are Go rather than compiled C, and contain an HTTP client in their string table. The README describes a tiny sockets/env-free sudoku puzzle generator (34,520 B linux ELF, 13,160 B darwin Mach-O), which contradicts what actually ships. Suspicious domain-shaped tokens `uaguBrDY.tk`, `id7TJrH.ga`, and `gIcKT3hfVC.co` appear in the Go binary's strings. The wrapper, README, and matching-arch binaries form a cover story that conceals an unrelated binary payload dropped and executed on x64 hosts at install time.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @workoscalif/sudoku (npm). Pin to a known-safe version or switch to an alternative.