Malicious code in novel-suduko (npm)
The npm package novel-suduko contained malicious code disguised as a sudoku hint utility. A postinstall script executed a 33 MB opaque native binary on Linux systems, despite the README falsely claiming the script only performed chmod operations. The binary contained references to cryptographic and container introspection facilities absent from the declared source code.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed novel-suduko during the malicious distribution window
- Ecosystems
- Attack vectors
- Affected entities
- novel-sudukonpm package containing malicious postinstall script
The npm package novel-suduko was distributed with a malicious postinstall lifecycle script that executed a bundled native binary (native/hint-linux-amd64) on every Linux x64 installation. The script used spawnSync() to execute the binary with inherited stdio, while silently catching and suppressing errors.
The package's README falsely claimed the postinstall script only performed chmod +x operations and executed nothing. However, analysis revealed the shipped native binary was 33,976,468 bytes—far larger than the ~2 MB expected from the declared source code (a simple Go sudoku hint program using only standard library packages like fmt, os, io, bufio, json, and strings).
String table analysis of the binary revealed references to cryptographic facilities (chacha8) and container introspection paths (/proc/self/cgroup, /proc/self/mountinfo) that do not appear in the declared source code. The build:native command in package.json could not reproduce the shipped artifact from the supplied source, confirming the binary was a malicious payload disguised by a benign decoy source file.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- novel-suduko
Remediation
- Immediately uninstall novel-suduko from all systems
- Audit npm install logs to identify when the package was installed
- Inspect affected systems for signs of unauthorized access or data exfiltration
- Review process execution logs for suspicious activity during and after npm install
- Consider the system compromised if installed; perform forensic analysis and rebuild if necessary
- Add novel-suduko to package blocklists and dependency scanning tools
- Monitor for similar patterns: postinstall scripts executing large opaque binaries that differ from declared source
Sources
- GitHub Advisory GHSA-vpp4-6mqx-vr57 · GitHub Advisory Database
Cite this entry
"Malicious code in novel-suduko (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-novel-suduko-npm-l7m2ud
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package