Malicious code in sotqa-test (npm)

The npm package sotqa-test was found to contain malicious code that executes on module import. The package loads a bootstrap.js file that reconstructs command-and-control (C2) hostnames from split-string arrays at runtime, including oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf100-416.workers.dev, with a DNS TXT covert-channel fallback using *.dl.well1.site resolvers.\n\nThe malicious code downloads platform-specific native binaries without hash or signature verification and writes them to temporary directories (/tmp on POSIX, %TEMP% on Windows) under disguised filenames (.cache on POSIX, dotnet_diag_.exe on Windows). The binaries are then executed detached via /bin/sh -c on Unix or cmd.exe on Windows.\n\nA second obfuscated dropper module in lib/telemetry.js, presented as an Analytics SDK, uses string concatenation to obscure child_process imports, assembles base64-encoded payloads, and spawns them detached, providing a parallel execution surface.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.