@workoscalif/sudoku

{"schema_version":"1.7.4","id":"MAL-2026-13366","published":"2026-08-05T18:08:10Z","modified":"2026-08-14T15:23:42.180664353Z","summary":"Malicious code in @workoscalif/sudoku (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217)\npackage.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes this file as a ~34 kB static ELF built from a ~150-line C sudoku generator (native/gridgen.c), but the shipped artifact is a ~33.6 MB Go runtime executable (strings include `runtime.`, `reflect.`, `GODEBUG`, `chacha8`, `godebugs.Info`) — roughly 1000x the advertised size and a different language/toolchain than the shipped source. The binary contains `/proc/self/cgroup` and `/proc/self/mountinfo` strings, which are container/CI environment fingerprints unrelated to generating sudoku puzzles. The postinstall short-circuits unless `process.platform === 'linux' && process.arch === 'x64'` and honors `SUDOKU_SKIP_POSTINSTALL=1`, so developer laptops (macOS/Windows) and reviewers using `--ignore-scripts` do not execute the binary. The npm scope `@workoscalif` visually resembles the WorkOS authentication vendor while the package is an unrelated personal project (author `anas cherni`, homepage github.com/anascherni/sudoku), increasing the likelihood a developer installs it believing it is vendor-endorsed. The combination of a documentation/contents mismatch, a large opaque binary from an unrelated toolchain, Linux-x64/CI gating, container fingerprinting strings, and a scope resembling a known vendor is the opaque-native-binary dropper shape rather than the advertised C sudoku helper.\n","affected":[{"package":{"name":"@workoscalif/sudoku","ecosystem":"npm"},"versions":["1.4.0","1.3.0","1.5.1","1.5.2","1.5.0","1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.mjs","sha256":"571bbe2b89e8ff9db1a35f6a66e05a9b629f82928c550b4771875cfbc3373686","tlsh":"8d71e77ec1956a7a02f059b0970ba212e7399027332af9f0f0ee82423f0760d4197dad"},{"path":"vendor/gridgen-linux-x64","sha256":"05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420","tlsh":"43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751"}],"package_integrity":[{"filename":"sudoku-1.5.2.tgz","hashes":{"sha1":"11fe4e3e9f0b6607855bfc3dae7a8af8152a5163","sha512_sri":"sha512-qWFIS3I5BZh90LBsAySIzbhKJrL1YbuHzQBHYyp7iD/MOPRx4FUZ4wonLI9bmWJn0zZV3ODJuG/wBdPnWJmnQA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalif/sudoku/v/1.4.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalif/sudoku/v/1.3.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalif/sudoku/v/1.5.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalif/sudoku/v/1.5.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalif/sudoku/v/1.5.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@workoscalif/sudoku/v/1.2.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015841","import_time":"2026-08-05T19:04:53.825087457Z","modified_time":"2026-08-05T18:08:10Z","sha256":"09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba","source":"amazon-inspector","versions":["1.4.0"]},{"id":"IN-MAL-2026-017895","import_time":"2026-08-14T15:21:28.552997745Z","modified_time":"2026-08-14T15:06:10Z","sha256":"3f4e1a9c3d2a0c7d1155e3926be3025532829075dbdcf8d997a2b828fad96452","source":"amazon-inspector","versions":["1.3.0"]},{"id":"IN-MAL-2026-017893","import_time":"2026-08-14T15:21:28.417084423Z","modified_time":"2026-08-14T15:05:53Z","sha256":"6fef5266b33f48c9812fa019016558568c887b0dbc3d0abf43f6e0870af9e9e9","source":"amazon-inspector","versions":["1.5.1"]},{"id":"IN-MAL-2026-017891","import_time":"2026-08-14T15:21:28.290044996Z","modified_time":"2026-08-14T15:05:36Z","sha256":"ba7aaa0d840c55240540de1408f5d0e103f3023466ec493200b2d9d1d9dba40d","source":"amazon-inspector","versions":["1.5.2"]},{"id":"IN-MAL-2026-017894","import_time":"2026-08-14T15:21:28.450725233Z","modified_time":"2026-08-14T15:06:02Z","sha256":"cac0141e2263aa5278da057552f67e4276b9534d2e3694b3a10aaaa8b6e42926","source":"amazon-inspector","versions":["1.5.0"]},{"id":"IN-MAL-2026-017892","import_time":"2026-08-14T15:21:28.352691711Z","modified_time":"2026-08-14T15:05:46Z","sha256":"d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217","source":"amazon-inspector","versions":["1.2.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}