The @workoscalif/sudoku npm package declares a postinstall script that runs a binary named gridgen-linux-x64 during installation on Linux x64 platforms. Although the README claims this binary is a small (~34 kB) C sudoku generator, the actual shipped binary is a ~33.6 MB Go runtime executable containing strings related to container and CI environment fingerprinting. The postinstall script only executes on Linux x64 and respects an environment variable to skip execution. The package scope visually resembles the WorkOS authentication vendor, increasing the risk of mistaken trust. The discrepancy between documentation and shipped content, combined with environment fingerprinting and opaque binary execution, classifies this package as a malicious native binary dropper.

This package can execute a large, opaque native binary during installation on Linux x64 systems, potentially enabling malicious actions such as environment fingerprinting and further payload execution. The misleading package scope and documentation increase the risk of inadvertent installation by developers. No known exploits in the wild have been reported yet.

No official patch or remediation is currently documented. Users should avoid installing the @workoscalif/sudoku package, especially on Linux x64 systems. Use npm install options such as --ignore-scripts to prevent execution of postinstall scripts. Verify package authenticity and source before installation, particularly for packages with suspicious scopes or mismatched documentation and contents.