The delivery-ci-validate-tinkoff-fb npm package version 35.6.9 includes a malicious payload triggered by requiring the package. Upon import, index.js calls _adapter.js, which constructs C2 hostnames dynamically and downloads a binary without version pinning or integrity verification. This binary is saved to a hidden temporary path, given executable permissions, and executed detached from the main process. The binary impersonates a Microsoft diagnostic tool on Windows and uses obfuscation techniques such as filesystem cooldown markers and telemetry-style naming to avoid detection. The validate() function exported by the package is a trivial stub and does not perform any validation, serving as a cover for the malicious dropper behavior.

This malicious package can execute arbitrary code on the host system by downloading and running an unverified binary from attacker-controlled servers. This can lead to unauthorized remote code execution, persistence, and potential further compromise of the affected system. The impersonation of legitimate tools and use of obfuscation techniques increase the difficulty of detection and removal.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.6.9) of the delivery-ci-validate-tinkoff-fb package from their environments. Avoid using this package until a trusted, verified version is released. Monitor for any unexpected binaries or processes matching the described behavior and investigate accordingly. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.