@workoscalif/sudoku@1.2.0

package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes this file as a ~34 kB static ELF built from a ~150-line C sudoku generator (native/gridgen.c), but the shipped artifact is a ~33.6 MB Go runtime executable (strings include `runtime.`, `reflect.`, `GODEBUG`, `chacha8`, `godebugs.Info`) — roughly 1000x the advertised size and a different language/toolchain than the shipped source. The binary contains `/proc/self/cgroup` and `/proc/self/mountinfo` strings, which are container/CI environment fingerprints unrelated to generating sudoku puzzles. The postinstall short-circuits unless `process.platform === 'linux' && process.arch === 'x64'` and honors `SUDOKU_SKIP_POSTINSTALL=1`, so developer laptops (macOS/Windows) and reviewers using `--ignore-scripts` do not execute the binary. The npm scope `@workoscalif` visually resembles the WorkOS authentication vendor while the package is an unrelated personal project (author `anas cherni`, homepage github.com/anascherni/sudoku), increasing the likelihood a developer installs it believing it is vendor-endorsed. The combination of a documentation/contents mismatch, a large opaque binary from an unrelated toolchain, Linux-x64/CI gating, container fingerprinting strings, and a scope resembling a known vendor is the opaque-native-binary dropper shape rather than the advertised C sudoku helper.