MAL-2026-13366

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@workoscalif/sudoku/MAL-2026-13366.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13366
Published
2026-08-05T18:08:10Z
Modified
2026-08-14T15:30:49Z
Summary
Malicious code in @workoscalif/sudoku (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217)

package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a ~34 kB static ELF built from a ~150-line C sudoku generator (native/gridgen.c), but the shipped artifact is a ~33.6 MB Go runtime executable (strings include runtime., reflect., GODEBUG, chacha8, godebugs.Info) — roughly 1000x the advertised size and a different language/toolchain than the shipped source. The binary contains /proc/self/cgroup and /proc/self/mountinfo strings, which are container/CI environment fingerprints unrelated to generating sudoku puzzles. The postinstall short-circuits unless process.platform === 'linux' && process.arch === 'x64' and honors SUDOKU_SKIP_POSTINSTALL=1, so developer laptops (macOS/Windows) and reviewers using --ignore-scripts do not execute the binary. The npm scope @workoscalif visually resembles the WorkOS authentication vendor while the package is an unrelated personal project (author anas cherni, homepage github.com/anascherni/sudoku), increasing the likelihood a developer installs it believing it is vendor-endorsed. The combination of a documentation/contents mismatch, a large opaque binary from an unrelated toolchain, Linux-x64/CI gating, container fingerprinting strings, and a scope resembling a known vendor is the opaque-native-binary dropper shape rather than the advertised C sudoku helper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015841",
            "import_time": "2026-08-05T19:04:53.825087457Z",
            "modified_time": "2026-08-05T18:08:10Z",
            "sha256": "09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba",
            "source": "amazon-inspector",
            "versions": [
                "1.4.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017895",
            "import_time": "2026-08-14T15:21:28.552997745Z",
            "modified_time": "2026-08-14T15:06:10Z",
            "sha256": "3f4e1a9c3d2a0c7d1155e3926be3025532829075dbdcf8d997a2b828fad96452",
            "source": "amazon-inspector",
            "versions": [
                "1.3.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017893",
            "import_time": "2026-08-14T15:21:28.417084423Z",
            "modified_time": "2026-08-14T15:05:53Z",
            "sha256": "6fef5266b33f48c9812fa019016558568c887b0dbc3d0abf43f6e0870af9e9e9",
            "source": "amazon-inspector",
            "versions": [
                "1.5.1"
            ]
        },
        {
            "id": "IN-MAL-2026-017891",
            "import_time": "2026-08-14T15:21:28.290044996Z",
            "modified_time": "2026-08-14T15:05:36Z",
            "sha256": "ba7aaa0d840c55240540de1408f5d0e103f3023466ec493200b2d9d1d9dba40d",
            "source": "amazon-inspector",
            "versions": [
                "1.5.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017894",
            "import_time": "2026-08-14T15:21:28.450725233Z",
            "modified_time": "2026-08-14T15:06:02Z",
            "sha256": "cac0141e2263aa5278da057552f67e4276b9534d2e3694b3a10aaaa8b6e42926",
            "source": "amazon-inspector",
            "versions": [
                "1.5.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017892",
            "import_time": "2026-08-14T15:21:28.352691711Z",
            "modified_time": "2026-08-14T15:05:46Z",
            "sha256": "d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @workoscalif/sudoku

Package

Name
@workoscalif/sudoku
View open source insights on deps.dev
Purl
pkg:npm/%40workoscalif/sudoku

Affected ranges

Affected versions

1.*
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
1.5.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.mjs",
            "sha256": "571bbe2b89e8ff9db1a35f6a66e05a9b629f82928c550b4771875cfbc3373686",
            "tlsh": "8d71e77ec1956a7a02f059b0970ba212e7399027332af9f0f0ee82423f0760d4197dad"
        },
        {
            "path": "vendor/gridgen-linux-x64",
            "sha256": "05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420",
            "tlsh": "43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751"
        }
    ],
    "package_integrity": [
        {
            "filename": "sudoku-1.5.2.tgz",
            "hashes": {
                "sha1": "11fe4e3e9f0b6607855bfc3dae7a8af8152a5163",
                "sha512_sri": "sha512-qWFIS3I5BZh90LBsAySIzbhKJrL1YbuHzQBHYyp7iD/MOPRx4FUZ4wonLI9bmWJn0zZV3ODJuG/wBdPnWJmnQA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@workoscalif/sudoku/MAL-2026-13366.json"