MAL-2026-14040

Dashboard / Malicious Package / MAL-2026-14040

MAL-2026-14040

Summary: Malicious code in @workoscalifant/sudoku-term (npm)

Details: Source: amazon-inspector (61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce) package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs prebuilt/linux-x64/sudoku-hint with '--selftest' on every Linux x64 installer. The shipped Linux artifact is a ~34 MB Go-runtime executable (sha256 ac6b4523fbe02c79129e58bdc8d613ddfb3a786c23dd03fa4ab28ab38ff3e6e5) containing Go runtime symbols, chacha8, and /proc/self/cgroup / /proc/self/mountinfo references. The corresponding darwin-x64 artifact built from the same declared source (native/hint.c, ~200 lines of pure C) is only 12,968 bytes and contains the expected C solver strings ('SUDOKU-HINT %s ok', 'naked single', '_row_mask'). The Linux binary is roughly 2,600x larger than its macOS counterpart and cannot be produced by the shipped build recipe (gcc -static hint.c), yet it is deliberately crafted to respond to '--selftest' with 'SUDOKU-HINT' so src/hint.js accepts it as the legitimate helper. The README additionally claims a '26 KB' static-musl ELF that 'opens no sockets', contradicting the shipped bytes. The installer therefore executes opaque, unverifiable native code from an untrusted source at install time under the guise of a small C sudoku solver.

References: https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.4, https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.5, https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.3, https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.1, https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.7, https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.2, https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.8