MalwarePublished 14 Aug 2026

@workoscalifant/sudoku-term (npm) · Malicious Code

Affects @workoscalifant/sudoku-termSource GCVE Database

Malicious package : remove @workoscalifant/sudoku-term and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14040

What to do

Remove @workoscalifant/sudoku-term from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@workoscalifant/sudoku-term	Affected 1.1.1 – 1.1.8 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @workoscalifant/sudoku-term includes a postinstall script that executes a large opaque Linux binary during installation. This binary is much larger than expected and differs significantly from the small C-based solver for macOS, suggesting it contains unverifiable native code. The installer runs this native code at install time, which poses a risk of executing malicious or unintended operations under the guise of a Sudoku solver helper.

Impact

The execution of a large, opaque native binary at install time from an untrusted source can lead to arbitrary code execution on the host system. Since the binary is unverifiable and much larger than expected, it may contain malicious payloads or perform unauthorized actions. This compromises the security and integrity of systems installing this package, potentially leading to system compromise or data loss.

Defensive guidance

Users should avoid installing or updating to the affected versions of @workoscalifant/sudoku-term. Review and verify the source and contents of native binaries before installation. Consider using alternative packages or solutions that do not execute opaque native code during installation. Monitor vendor advisories for any updates or remediation guidance.

Summary

The @workoscalifant/sudoku-term npm package declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which synchronously executes a prebuilt Linux x64 binary named sudoku-hint with the '--selftest' argument. The shipped Linux binary is approximately 34 MB, containing Go runtime symbols and references to system files, contrasting sharply with the much smaller (~13 KB) macOS binary built from a simple C source. The large Linux binary cannot be produced by the declared build process and is crafted to respond to '--selftest' to appear legitimate to the JavaScript code. The README's claim of a small static ELF binary contradicts the actual shipped artifact. This means the installer runs opaque, unverifiable native code from an untrusted source during installation, which is a significant security risk.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:43 UTC

Technical details

References

Community reviews