@workoscalif/sudoku @1.4.0

Summary

@workoscalif/sudoku@1.4.0 declares postinstall: node scripts/postinstall.mjs , which spawns vendor/gridgen-${process.platform}-${process.arch} on npm install . The linux-x64 and darwin-x64 slots both contain the same 33,648,788-byte ELF Go binary (sha256 05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420), including a Mach-O slot that actually contains an ELF. The shipped C source native/gridgen.c is ~250 lines of pure computation with no I/O, and the arm64 binaries compile to 34-67 KB from that source; the x64 binaries are ~500x larger, are Go rather than compiled C, and contain an HTTP client in their string table. The README describes a tiny sockets/env-free sudoku puzzle generator (34,520 B linux ELF, 13,160 B darwin Mach-O), which contradicts what actually ships. Suspicious domain-shaped tokens uaguBrDY.tk , id7TJrH.ga , and gIcKT3hfVC.co appear in the Go binary's strings. The wrapper, README, and matching-arch binaries form a cover story that conceals an unrelated binary payload dropped and executed on x64 hosts at install time.

Source: amazon-inspector (09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba)