MAL-2026-13736

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe) The package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-<platform>-<arch> as its compiled output. The darwin-arm64 slot contains a ~34KB Mach-O consistent with that C source, but vendor/solver-darwin-x64 and vendor/solver-linux-x64 are identical 33,648,788-byte Linux ELF Go binaries (same sha256 05b69666...4420) that link net/http, os/exec, crypto/chacha8, and reference /proc/self/. The postinstall script invokes spawnSync(BINARY, ['selftest']) on install, so on Linux x64 hosts the shipped opaque Go binary runs automatically at install time. The binary's linked packages (network client, process execution, symmetric crypto) and ~1000x size inflation over any plausible build of the declared C algorithm are inconsistent with the documented purpose, and the darwin-x64 slot being populated with a Linux ELF further indicates the vendor tree was not built from the shipped C source. The install-time execution path against unverified, purpose-mismatched bytes on Linux x64 is a fetch-and-execute equivalent embedded in the tarball rather than downloaded, and the destination of any network activity performed by the Go binary cannot be determined from strings alone.