The 'sotqa-test' npm package (version 20.3.8) includes malicious functionality where, upon requiring the package, it loads a bootstrap script that reconstructs C2 hostnames from split strings and uses a DNS TXT covert channel fallback. It downloads a native binary over HTTPS, saves it to temporary directories with disguised filenames, sets executable permissions, and spawns it detached using shell commands. A secondary obfuscated dropper module ('lib/telemetry.js') masquerades as an Analytics SDK, dynamically resolves 'child_process', decodes a base64 payload, sets executable permissions, and executes it detached. There is no integrity verification of downloaded binaries, and endpoints are mutable, increasing risk. This behavior results in full system compromise.

Any system with this package installed or running should be considered fully compromised. The attacker may gain full control over the system, including the ability to execute arbitrary native code. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

Immediate removal of the 'sotqa-test' package version 20.3.8 is recommended. All secrets and keys stored on the affected system should be rotated from a different, trusted machine. Due to the nature of the compromise, a full system forensic investigation and potential rebuild may be necessary to ensure complete remediation. No official patch or fix is currently available. Monitor vendor advisories for updates.