🛡️ MAL-2026-12071 — sotqa-test

Malicious code in sotqa-test (npm)

Source: amazon-inspector

On require, sotqa-test loads _bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT covert-channel fallback under *.dl.well1.site resolvers (tin, tina, ldr, win subdomains), downloads a platform-specific native binary via https.get, writes it to /tmp or %TEMP% under a disguised filename (.cache_<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. There is no hash or signature verification, endpoints are mutable, and both the delivery hosts and dropped-file names use cover-story naming (analytics, dotnet_diag). A second obfuscated dropper module lib/telemetry.js — presented as an Analytics SDK — resolves child_process via string concatenation ("child_"+"process"), assembles a base64 payload buffer, chmods the artifact 0755 using fs["chmod"+"Sync"], and spawns it detached with /bin/sh -c, providing a parallel execution surface.