The npm package @workoscalifant/sudoku-term includes a postinstall script that executes a large opaque Linux binary during installation. This binary is much larger than expected and differs significantly from the small C-based solver for macOS, suggesting it contains unverifiable native code. The installer runs this native code at install time, which poses a risk of executing malicious or unintended operations under the guise of a Sudoku solver helper.