Which versions of @workoscalifant/sudoku-term are malicious?

The following npm versions of @workoscalifant/sudoku-term are flagged malicious: 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.7, 1.1.8. Treat any of these as compromised.

How do I remediate @workoscalifant/sudoku-term if I installed it?

@workoscalifant/sudoku-term establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed @workoscalifant/sudoku-term — how do I know if it already compromised me?

If @workoscalifant/sudoku-term was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @workoscalifant/sudoku-term part of a known attack campaign?

Yes — @workoscalifant/sudoku-term is associated with the IN-MAL-2026-017897, IN-MAL-2026-017902, IN-MAL-2026-017898, IN-MAL-2026-017901, IN-MAL-2026-017896, IN-MAL-2026-017900, IN-MAL-2026-017899 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @workoscalifant/sudoku-term across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @workoscalifant/sudoku-term (7 malicious versions).

Malicious package

@workoscalifant/sudoku-termnpm

Advisory published Aug 14, 2026Updated Aug 14, 2026

@workoscalifant/sudoku-term is a confirmed malicious npm package (MAL-2026-14040) that opens a backdoor for remote access (malicious versions 1.1.1, 1.1.2, 1.1.3…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @workoscalifant/sudoku-term (npm)

MAL-2026-14040

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @workoscalifant/sudoku-term

What this malware does

package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs prebuilt/linux-x64/sudoku-hint with '--selftest' on every Linux x64 installer. The shipped Linux artifact is a ~34 MB Go-runtime executable (sha256 ac6b4523fbe02c79129e58bdc8d613ddfb3a786c23dd03fa4ab28ab38ff3e6e5) containing Go runtime symbols, chacha8, and /proc/self/cgroup / /proc/self/mountinfo references. The corresponding darwin-x64 artifact built from the same declared source (native/hint.c, ~200 lines of pure C) is only 12,968 bytes and contains the expected C solver strings ('SUDOKU-HINT %s ok', 'naked single', '_row_mask'). The Linux binary is roughly 2,600x larger than its macOS counterpart and cannot be produced by the shipped build recipe (gcc -static hint.c), yet it is deliberately crafted to respond to '--selftest' with 'SUDOKU-HINT' so src/hint.js accepts it as the legitimate helper. The README additionally claims a '26 KB' static-musl ELF that 'opens no sockets', contradicting the shipped bytes. The installer therefore executes opaque, unverifiable native code from an untrusted source at install time under the guise of a small C sudoku solver.

Malicious versions

7 flagged

1.1.11.1.21.1.31.1.41.1.51.1.71.1.8

Indicators of compromise (SHA-256)

43c918d669056b4820e50677aac77f32705e97a0c977ef9dfff896001822cfed

cbaeb3406aceac57f5ea4404e798079a06ee5cbc88c61b492ac545049aacdcce

e8b26deac267113efacf8686d6eb6d3e68033bd65a0781c059b4b9875b226740

61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce

6e46dc62a8e4e085911290c5e2316152b523f01076841e74cfc64988c57bd627

6f2de2d7017ef54c9aa0c6ae729847bfe3fec0b9723192354fafc52cc72d95b3

9a76f26b7dd5b01bb289283cd67bc755b72f00a77c901445f3b86ca8efc72362

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for @workoscalifant/sudoku-term (7 malicious versions).
If you installed it — respond
@workoscalifant/sudoku-term establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If @workoscalifant/sudoku-term was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @workoscalifant/sudoku-term on npm has been identified as a malicious package (versions 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.7, 1.1.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017897IN-MAL-2026-017902IN-MAL-2026-017898IN-MAL-2026-017901IN-MAL-2026-017896IN-MAL-2026-017900IN-MAL-2026-017899

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @workoscalifant/sudoku-term-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database