GCVE-110-OSM-2026-10474

package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs prebuilt/linux-x64/sudoku-hint with '--selftest' on every Linux x64 installer. The shipped Linux artifact is a ~34 MB Go-runtime executable (sha256 ac6b4523fbe02c79129e58bdc8d613ddfb3a786c23dd03fa4ab28ab38ff3e6e5) containing Go runtime symbols, chacha8, and /proc/self/cgroup / /proc/self/mountinfo references. The corresponding darwin-x64 artifact built from the same declared source (native/hint.c, ~200 lines of pure C) is only 12,968 bytes and contains the expected C solver strings ('SUDOKU-HINT %s ok', 'naked single', '_row_mask'). The Linux binary is roughly 2,600x larger than its macOS counterpart and cannot be produced by the shipped build recipe (gcc -static hint.c), yet it is deliberately crafted to respond to '--selftest' with 'SUDOKU-HINT' so src/hint.js accepts it as the legitimate helper. The README additionally claims a '26 KB' static-musl ELF that 'opens no sockets', contradicting the shipped bytes. The installer therefore executes opaque, unverifiable native code from an untrusted source at install time under the guise of a small C sudoku solver. Judge assessment: This package is consistent with a supply-chain trojan that abuses a postinstall hook to run opaque native code during installation. The attacker model is a compromised or malicious publisher shipping a fake Sudoku utility that hides its real payload behind a "native x64 hint engine"; the OSV advisory and the package's own install path both point to install-time execution of unverifiable code. `scripts/postinstall.js` calls `nativeBinaryPath()` and, when absent, runs `sh native/build.sh` with `stdio: 'ignore'`, which suppresses output and makes the install behavior harder to inspect. The fresh publisher account (`new-npm-account-week`, `new-package-week`) and the advisory's description of a mismatched Linux binary versus small C solver further corroborate malicious supply-chain intent. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in src/hint.js: "process.platform" ADDITIONAL FINDINGS - Silent Process Execution in scripts/postinstall.js: "stdio: 'ignore'" - Very New NPM Publisher Account PAYLOAD FILES src/hint.js (+ scripts/postinstall.js)