Malicious code in @workoscalifant/sudoku-term (npm)
The npm package @workoscalifant/sudoku-term contained a malicious prebuilt Linux x64 binary disguised as a legitimate sudoku solver helper. The postinstall script executed this opaque ~34 MB Go-runtime executable on every Linux x64 installation, despite the package claiming to ship a 26 KB static-musl binary.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed @workoscalifant/sudoku-term during the malicious period.
- Ecosystems
- Attack vectors
- Affected entities
- @workoscalifant/sudoku-termnpm package containing malicious prebuilt Linux x64 binary
The @workoscalifant/sudoku-term npm package contained malicious native code in its prebuilt binaries. The package.json declared a postinstall script that imported src/hint.js and executed a prebuilt Linux x64 binary (prebuilt/linux-x64/sudoku-hint) with the '--selftest' flag on every installation.
The shipped Linux artifact was a ~34 MB Go-runtime executable (sha256 ac6b4523fbe02c79129e58bdc8d613ddfb3a786c23dd03fa4ab28ab38ff3e6e5) containing Go runtime symbols, chacha8, and references to /proc/self/cgroup and /proc/self/mountinfo. In stark contrast, the corresponding darwin-x64 artifact was only 12,968 bytes and contained expected C solver strings consistent with the declared source (native/hint.c, ~200 lines of pure C).
The Linux binary was approximately 2,600x larger than its macOS counterpart and could not have been produced by the shipped build recipe (gcc -static hint.c). However, it was deliberately crafted to respond to the '--selftest' flag with 'SUDOKU-HINT' to pass validation checks in src/hint.js. The package README falsely claimed a '26 KB' static-musl ELF that 'opens no sockets', contradicting the actual shipped binary size and behavior.
This incident represents a supply chain attack where opaque, unverifiable native code was executed at install time under the guise of a legitimate sudoku solver utility.
Indicators of compromise
- Packages
- @workoscalifant/sudoku-term
- Hashes
- ac6b4523fbe02c79129e58bdc8d613ddfb3a786c23dd03fa4ab28ab38ff3e6e5
Remediation
- Remove @workoscalifant/sudoku-term from all projects immediately
- Audit npm install logs to identify when the malicious package was installed
- Assume any system that installed this package during the malicious period may be compromised; perform forensic analysis for signs of the Go-runtime executable execution
- Review npm audit and dependency scanning tools to detect similar mismatches between declared source and shipped binaries
- Consider using npm package signature verification and binary attestation tools to prevent similar attacks
Sources
- GitHub Advisory GHSA-g37v-757m-3jhh · GitHub Advisory Database
Cite this entry
"Malicious code in @workoscalifant/sudoku-term (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-workoscalifant-sudoku-term-npm-1dtxyt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package