This malicious npm package, identified as tinkoff-boxy-desktop-two-panel-right-image version 20.4.8, loads a script that detects the host OS and architecture, then downloads platform-specific native binaries from split and assembled hostnames under Cloudflare Workers subdomains and a DDNS-style domain. The binaries are stored in temporary directories with decoy names, made executable, and executed detached from the main process. A secondary module, lib/telemetry.js, also performs the same download and execution chain under the guise of an analytics SDK. The downloaded native code is opaque and executed without verification, effectively giving full control of the host to the attacker. The package presence indicates a full system compromise.

Systems with this package installed are fully compromised, as the malicious code downloads and executes arbitrary native binaries with no verification. This can lead to complete attacker control over the host, risking theft of all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious artifacts or persistence mechanisms.

Immediate removal of the tinkoff-boxy-desktop-two-panel-right-image package version 20.4.8 is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted device. Due to the nature of the compromise, a full system forensic analysis and potential rebuild is recommended to ensure no residual malicious code remains. There is no official patch or fix available; remediation relies on removal and credential rotation.