MAL-2026-14040 Malicious code in @workoscalifant/sudoku-term (npm)

package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs prebuilt/linux-x64/sudoku-hint with '–selftest' on every Linux x64 installer. The shipped Linux artifact is a ~34 MB Go-runtime executable (sha256 ac6b4523fbe02c79129e58bdc8d613ddfb3a786c23dd03fa4ab28ab38ff3e6e5) containing Go runtime symbols, chacha8, and /proc/self/cgroup / /proc/self/mountinfo references. The corresponding darwin-x64 artifact built from the same declared source (native/hint.c, ~200 lines of pure C) is only 12,968 bytes and contains the expected C solver strings ('SUDOKU-HINT %s ok', 'naked single', '_row_mask'). The Linux binary is roughly 2,600x larger than its macOS counterpart and cannot be produced by the shipped build recipe (gcc -static hint.c), yet it is deliberately crafted to respond to '–selftest' with 'SUDOKU-HINT' so src/hint.js accepts it as the legitimate helper. The README additionally claims a '26 KB' static-musl ELF that 'opens no sockets', contradicting the shipped bytes. The installer therefore executes opaque, unverifiable native code from an untrusted source at install time under the guise of a small C sudoku solver.