{"id":"MAL-2026-14040","summary":"Malicious code in @workoscalifant/sudoku-term (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce)\npackage.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs prebuilt/linux-x64/sudoku-hint with '--selftest' on every Linux x64 installer. The shipped Linux artifact is a ~34 MB Go-runtime executable (sha256 ac6b4523fbe02c79129e58bdc8d613ddfb3a786c23dd03fa4ab28ab38ff3e6e5) containing Go runtime symbols, chacha8, and /proc/self/cgroup / /proc/self/mountinfo references. The corresponding darwin-x64 artifact built from the same declared source (native/hint.c, ~200 lines of pure C) is only 12,968 bytes and contains the expected C solver strings ('SUDOKU-HINT %s ok', 'naked single', '_row_mask'). The Linux binary is roughly 2,600x larger than its macOS counterpart and cannot be produced by the shipped build recipe (gcc -static hint.c), yet it is deliberately crafted to respond to '--selftest' with 'SUDOKU-HINT' so src/hint.js accepts it as the legitimate helper. The README additionally claims a '26 KB' static-musl ELF that 'opens no sockets', contradicting the shipped bytes. The installer therefore executes opaque, unverifiable native code from an untrusted source at install time under the guise of a small C sudoku solver.\n","modified":"2026-08-14T15:30:49.718630515Z","published":"2026-08-14T15:06:20Z","database_specific":{"malicious-packages-origins":[{"versions":["1.1.4"],"id":"IN-MAL-2026-017897","import_time":"2026-08-14T15:21:28.650646018Z","modified_time":"2026-08-14T15:06:31Z","sha256":"43c918d669056b4820e50677aac77f32705e97a0c977ef9dfff896001822cfed","source":"amazon-inspector"},{"sha256":"cbaeb3406aceac57f5ea4404e798079a06ee5cbc88c61b492ac545049aacdcce","source":"amazon-inspector","versions":["1.1.5"],"id":"IN-MAL-2026-017902","import_time":"2026-08-14T15:21:28.961824262Z","modified_time":"2026-08-14T15:07:20Z"},{"versions":["1.1.3"],"id":"IN-MAL-2026-017898","import_time":"2026-08-14T15:21:28.736132384Z","modified_time":"2026-08-14T15:06:42Z","sha256":"e8b26deac267113efacf8686d6eb6d3e68033bd65a0781c059b4b9875b226740","source":"amazon-inspector"},{"import_time":"2026-08-14T15:21:28.925845836Z","modified_time":"2026-08-14T15:07:11Z","sha256":"61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce","source":"amazon-inspector","versions":["1.1.1"],"id":"IN-MAL-2026-017901"},{"source":"amazon-inspector","versions":["1.1.7"],"id":"IN-MAL-2026-017896","import_time":"2026-08-14T15:21:28.603934188Z","modified_time":"2026-08-14T15:06:20Z","sha256":"6e46dc62a8e4e085911290c5e2316152b523f01076841e74cfc64988c57bd627"},{"id":"IN-MAL-2026-017900","import_time":"2026-08-14T15:21:28.888115324Z","modified_time":"2026-08-14T15:07:02Z","sha256":"6f2de2d7017ef54c9aa0c6ae729847bfe3fec0b9723192354fafc52cc72d95b3","source":"amazon-inspector","versions":["1.1.2"]},{"sha256":"9a76f26b7dd5b01bb289283cd67bc755b72f00a77c901445f3b86ca8efc72362","source":"amazon-inspector","versions":["1.1.8"],"id":"IN-MAL-2026-017899","import_time":"2026-08-14T15:21:28.831622666Z","modified_time":"2026-08-14T15:06:53Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalifant/sudoku-term/v/1.1.8"}],"affected":[{"package":{"name":"@workoscalifant/sudoku-term","ecosystem":"npm","purl":"pkg:npm/%40workoscalifant/sudoku-term"},"versions":["1.1.4","1.1.5","1.1.3","1.1.1","1.1.7","1.1.2","1.1.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@workoscalifant/sudoku-term/MAL-2026-14040.json","indicators":{"evidence_files":[{"sha256":"0ca66e9fc13c045a7299fc87844011e353d59b6578e79138f17209c301522ef6","tlsh":"b401fda64f0d1b928b214bd0031cb1e61fa3c0704b81ad70929f8e24338630032461eb","path":"scripts/postinstall.js"},{"path":"README.md","sha256":"d23938c4ac457e85b92335bbbab50ef90a1ebcdcc4368f4192d42b3c658763f0","tlsh":"148185318b00b76d3fd1d2ad9a0736f4aa14b8b6f781d855bc4e741183ce07101a5df2"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-/SadEEkikUnS1ot/XeNFE42TQi44Rah2B61MG6rxC2q3uPWAc4r3D/hepgiCoripFHWl2ebsj9i3zO+c2shPCw==","sha1":"179e52b504ebfd1fa16ba4d764442bc53c71ae72"},"filename":"sudoku-term-1.1.8.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}