The tinkoff-boxy-gitlab-labels npm package version 20.5.4 loads a runtime script that fetches a platform-specific native binary payload from multiple obfuscated Cloudflare Workers hosts using DNS-TXT chunked base64 fallback mechanisms. The downloaded payload is written to temporary directories with randomized, disguised filenames and executed detached via shell commands. The package employs obfuscation techniques such as runtime hostname assembly and silent error suppression to evade detection. The presence of this package on a system indicates a full compromise, with potential unauthorized control over the host.

Systems with tinkoff-boxy-gitlab-labels version 20.5.4 installed are fully compromised, allowing an attacker to execute arbitrary native code on the host. This compromises all secrets and keys stored on the system, requiring immediate rotation from a clean environment. Removal of the package alone does not guarantee eradication of the malicious payload or persistence mechanisms.

Remove the tinkoff-boxy-gitlab-labels package version 20.5.4 immediately. Consider the host fully compromised and perform a thorough incident response, including rotating all secrets and keys from a separate, trusted system. There is no known patch or official fix; remediation requires removal and comprehensive system recovery.