MAL-2026-13366

Dashboard / Malicious Package / MAL-2026-13366

MAL-2026-13366

Summary: Malicious code in @workoscalif/sudoku (npm)

Details: Source: amazon-inspector (d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217) package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes this file as a ~34 kB static ELF built from a ~150-line C sudoku generator (native/gridgen.c), but the shipped artifact is a ~33.6 MB Go runtime executable (strings include `runtime.`, `reflect.`, `GODEBUG`, `chacha8`, `godebugs.Info`) — roughly 1000x the advertised size and a different language/toolchain than the shipped source. The binary contains `/proc/self/cgroup` and `/proc/self/mountinfo` strings, which are container/CI environment fingerprints unrelated to generating sudoku puzzles. The postinstall short-circuits unless `process.platform === 'linux' && process.arch === 'x64'` and honors `SUDOKU_SKIP_POSTINSTALL=1`, so developer laptops (macOS/Windows) and reviewers using `--ignore-scripts` do not execute the binary. The npm scope `@workoscalif` visually resembles the WorkOS authentication vendor while the package is an unrelated personal project (author `anas cherni`, homepage github.com/anascherni/sudoku), increasing the likelihood a developer installs it believing it is vendor-endorsed. The combination of a documentation/contents mismatch, a large opaque binary from an unrelated toolchain, Linux-x64/CI gating, container fingerprinting strings, and a scope resembling a known vendor is the opaque-native-binary dropper shape rather than the advertised C sudoku helper.

References: https://www.npmjs.com/package/@workoscalif/sudoku/v/1.4.0, https://www.npmjs.com/package/@workoscalif/sudoku/v/1.3.0, https://www.npmjs.com/package/@workoscalif/sudoku/v/1.5.1, https://www.npmjs.com/package/@workoscalif/sudoku/v/1.5.2, https://www.npmjs.com/package/@workoscalif/sudoku/v/1.5.0, https://www.npmjs.com/package/@workoscalif/sudoku/v/1.2.0