Malicious code in novel-suduko (npm)

The novel-suduko npm package version 1.0.1 includes a postinstall lifecycle script that runs a bundled native binary (native/hint-linux-amd64) on every Linux x64 installation. Although the source Go code (native/src/hint.go) appears to be a simple Sudoku hint program, the actual shipped binary is approximately 33.9 MB, far larger than expected, and contains references to cryptographic functions and Linux system files not present in the source. The declared build command cannot reproduce the shipped binary from the source, indicating the source is a decoy and the binary contains hidden malicious payloads executed silently during npm install.

Installation of novel-suduko version 1.0.1 on Linux x64 systems results in execution of a large opaque native binary with unknown malicious capabilities. This can lead to compromise of the installer's machine during package installation without user awareness, as errors are silently caught and only logged to the console. The exact impact depends on the payload within the binary but includes potential unauthorized code execution and system compromise.

Users should avoid installing novel-suduko version 1.0.1. Since no patch or fix is indicated, the safest mitigation is to remove the package from projects and replace it with a trusted alternative. Monitor for updates or advisories from the package maintainers or npm registry. Do not run npm install commands for this package on Linux x64 systems until a verified clean version is available.