MalwarePublished 5 Aug 2026Updated 14 Aug 2026

@workoscalif/sudoku (npm) · Malicious Code

Affects @workoscalif/sudokuSource GCVE Database

Malicious package : remove @workoscalif/sudoku and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13366

What to do

Remove @workoscalif/sudoku from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@workoscalif/sudoku	Affected 1.2.0 – 1.5.2 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @workoscalif/sudoku contains a malicious postinstall script that executes a large opaque Linux x64 binary disguised as a small C sudoku generator. The binary is a Go runtime executable with container and CI environment fingerprinting capabilities, inconsistent with the advertised functionality. The package scope mimics a known vendor, potentially misleading developers to install it unintentionally. This behavior indicates a malicious native binary dropper rather than a legitimate sudoku helper.

Impact

This package can execute a large, opaque native binary during installation on Linux x64 systems, potentially enabling malicious actions such as environment fingerprinting and further payload execution. The misleading package scope and documentation increase the risk of inadvertent installation by developers. No known exploits in the wild have been reported yet.

Defensive guidance

Users should avoid installing the @workoscalif/sudoku package, especially on Linux x64 systems. Use npm install options such as --ignore-scripts to prevent execution of postinstall scripts. Verify package authenticity and source before installation, particularly for packages with suspicious scopes or mismatched documentation and contents.

Summary

The @workoscalif/sudoku npm package declares a postinstall script that runs a binary named gridgen-linux-x64 during installation on Linux x64 platforms. Although the README claims this binary is a small (~34 kB) C sudoku generator, the actual shipped binary is a ~33.6 MB Go runtime executable containing strings related to container and CI environment fingerprinting. The postinstall script only executes on Linux x64 and respects an environment variable to skip execution. The package scope visually resembles the WorkOS authentication vendor, increasing the risk of mistaken trust. The discrepancy between documentation and shipped content, combined with environment fingerprinting and opaque binary execution, classifies this package as a malicious native binary dropper.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:43 UTC

Technical details

References

Community reviews