MAL-2026-13366

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba) @workoscalif/sudoku@1.4.0 declares `postinstall: node scripts/postinstall.mjs`, which spawns `vendor/gridgen-${process.platform}-${process.arch}` on `npm install`. The linux-x64 and darwin-x64 slots both contain the same 33,648,788-byte ELF Go binary (sha256 05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420), including a Mach-O slot that actually contains an ELF. The shipped C source `native/gridgen.c` is ~250 lines of pure computation with no I/O, and the arm64 binaries compile to 34-67 KB from that source; the x64 binaries are ~500x larger, are Go rather than compiled C, and contain an HTTP client in their string table. The README describes a tiny sockets/env-free sudoku puzzle generator (34,520 B linux ELF, 13,160 B darwin Mach-O), which contradicts what actually ships. Suspicious domain-shaped tokens `uaguBrDY.tk`, `id7TJrH.ga`, and `gIcKT3hfVC.co` appear in the Go binary's strings. The wrapper, README, and matching-arch binaries form a cover story that conceals an unrelated binary payload dropped and executed on x64 hosts at install time.