MAL-2026-13366

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@workoscalif/sudoku/MAL-2026-13366.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13366
Published
2026-08-05T18:08:10Z
Modified
2026-08-05T19:19:48.965662574Z
Summary
Malicious code in @workoscalif/sudoku (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba)

@workoscalif/sudoku@1.4.0 declares postinstall: node scripts/postinstall.mjs, which spawns vendor/gridgen-${process.platform}-${process.arch} on npm install. The linux-x64 and darwin-x64 slots both contain the same 33,648,788-byte ELF Go binary (sha256 05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420), including a Mach-O slot that actually contains an ELF. The shipped C source native/gridgen.c is ~250 lines of pure computation with no I/O, and the arm64 binaries compile to 34-67 KB from that source; the x64 binaries are ~500x larger, are Go rather than compiled C, and contain an HTTP client in their string table. The README describes a tiny sockets/env-free sudoku puzzle generator (34,520 B linux ELF, 13,160 B darwin Mach-O), which contradicts what actually ships. Suspicious domain-shaped tokens uaguBrDY.tk, id7TJrH.ga, and gIcKT3hfVC.co appear in the Go binary's strings. The wrapper, README, and matching-arch binaries form a cover story that conceals an unrelated binary payload dropped and executed on x64 hosts at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba",
            "modified_time": "2026-08-05T18:08:10Z",
            "import_time": "2026-08-05T19:04:53.825087457Z",
            "versions": [
                "1.4.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015841"
        }
    ]
}
References
Credits

Affected packages

npm / @workoscalif/sudoku

Package

Name
@workoscalif/sudoku
View open source insights on deps.dev
Purl
pkg:npm/%40workoscalif/sudoku

Affected ranges

Affected versions

1.*
1.4.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.mjs",
            "sha256": "571bbe2b89e8ff9db1a35f6a66e05a9b629f82928c550b4771875cfbc3373686",
            "tlsh": "8d71e77ec1956a7a02f059b0970ba212e7399027332af9f0f0ee82423f0760d4197dad"
        },
        {
            "path": "vendor/gridgen-linux-x64",
            "tlsh": "43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751",
            "sha256": "05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@workoscalif/sudoku/MAL-2026-13366.json"