MAL-2026-13366 Malicious code in @workoscalif/sudoku (npm)

package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a ~34 kB static ELF built from a ~150-line C sudoku generator (native/gridgen.c), but the shipped artifact is a ~33.6 MB Go runtime executable (strings include runtime., reflect., GODEBUG, chacha8, godebugs.Info) — roughly 1000x the advertised size and a different language/toolchain than the shipped source. The binary contains /proc/self/cgroup and /proc/self/mountinfo strings, which are container/CI environment fingerprints unrelated to generating sudoku puzzles. The postinstall short-circuits unless process.platform === 'linux' && process.arch === 'x64' and honors SUDOKU_SKIP_POSTINSTALL=1, so developer laptops (macOS/Windows) and reviewers using --ignore-scripts do not execute the binary. The npm scope @workoscalif visually resembles the WorkOS authentication vendor while the package is an unrelated personal project (author anas cherni, homepage github.com/anascherni/sudoku), increasing the likelihood a developer installs it believing it is vendor-endorsed. The combination of a documentation/contents mismatch, a large opaque binary from an unrelated toolchain, Linux-x64/CI gating, container fingerprinting strings, and a scope resembling a known vendor is the opaque-native-binary dropper shape rather than the advertised C sudoku helper.