MAL-2026-13366

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@workoscalif/sudoku/MAL-2026-13366.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13366
Published
2026-08-05T18:08:10Z
Modified
2026-08-14T15:30:49Z
Summary
Malicious code in @workoscalif/sudoku (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217)

package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a ~34 kB static ELF built from a ~150-line C sudoku generator (native/gridgen.c), but the shipped artifact is a ~33.6 MB Go runtime executable (strings include runtime., reflect., GODEBUG, chacha8, godebugs.Info) — roughly 1000x the advertised size and a different language/toolchain than the shipped source. The binary contains /proc/self/cgroup and /proc/self/mountinfo strings, which are container/CI environment fingerprints unrelated to generating sudoku puzzles. The postinstall short-circuits unless process.platform === 'linux' && process.arch === 'x64' and honors SUDOKU_SKIP_POSTINSTALL=1, so developer laptops (macOS/Windows) and reviewers using --ignore-scripts do not execute the binary. The npm scope @workoscalif visually resembles the WorkOS authentication vendor while the package is an unrelated personal project (author anas cherni, homepage github.com/anascherni/sudoku), increasing the likelihood a developer installs it believing it is vendor-endorsed. The combination of a documentation/contents mismatch, a large opaque binary from an unrelated toolchain, Linux-x64/CI gating, container fingerprinting strings, and a scope resembling a known vendor is the opaque-native-binary dropper shape rather than the advertised C sudoku helper.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-015841",
            "import_time":  "2026-08-05T19:04:53.825087457Z",
            "modified_time":  "2026-08-05T18:08:10Z",
            "sha256":  "09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba",
            "source":  "amazon-inspector",
            "versions":  [
                "1.4.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-017895",
            "import_time":  "2026-08-14T15:21:28.552997745Z",
            "modified_time":  "2026-08-14T15:06:10Z",
            "sha256":  "3f4e1a9c3d2a0c7d1155e3926be3025532829075dbdcf8d997a2b828fad96452",
            "source":  "amazon-inspector",
            "versions":  [
                "1.3.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-017893",
            "import_time":  "2026-08-14T15:21:28.417084423Z",
            "modified_time":  "2026-08-14T15:05:53Z",
            "sha256":  "6fef5266b33f48c9812fa019016558568c887b0dbc3d0abf43f6e0870af9e9e9",
            "source":  "amazon-inspector",
            "versions":  [
                "1.5.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-017891",
            "import_time":  "2026-08-14T15:21:28.290044996Z",
            "modified_time":  "2026-08-14T15:05:36Z",
            "sha256":  "ba7aaa0d840c55240540de1408f5d0e103f3023466ec493200b2d9d1d9dba40d",
            "source":  "amazon-inspector",
            "versions":  [
                "1.5.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-017894",
            "import_time":  "2026-08-14T15:21:28.450725233Z",
            "modified_time":  "2026-08-14T15:06:02Z",
            "sha256":  "cac0141e2263aa5278da057552f67e4276b9534d2e3694b3a10aaaa8b6e42926",
            "source":  "amazon-inspector",
            "versions":  [
                "1.5.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-017892",
            "import_time":  "2026-08-14T15:21:28.352691711Z",
            "modified_time":  "2026-08-14T15:05:46Z",
            "sha256":  "d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @workoscalif/sudoku

Package

Name
@workoscalif/sudoku
View open source insights on deps.dev
Purl
pkg:npm/%40workoscalif/sudoku

Affected ranges

Affected versions

1.*
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
1.5.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "scripts/postinstall.mjs",
            "sha256":  "571bbe2b89e8ff9db1a35f6a66e05a9b629f82928c550b4771875cfbc3373686",
            "tlsh":  "8d71e77ec1956a7a02f059b0970ba212e7399027332af9f0f0ee82423f0760d4197dad"
        },
        {
            "path":  "vendor/gridgen-linux-x64",
            "sha256":  "05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420",
            "tlsh":  "43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "sudoku-1.5.2.tgz",
            "hashes":  {
                "sha1":  "11fe4e3e9f0b6607855bfc3dae7a8af8152a5163",
                "sha512_sri":  "sha512-qWFIS3I5BZh90LBsAySIzbhKJrL1YbuHzQBHYyp7iD/MOPRx4FUZ4wonLI9bmWJn0zZV3ODJuG/wBdPnWJmnQA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@workoscalif/sudoku/MAL-2026-13366.json"