The npm package tinkoff-codeceptjs-storyshots-alpha (version 20.8.9) includes a malicious index.js that unconditionally requires a _bootstrap.js script. This script dynamically constructs URLs to fetch opaque native binaries from Cloudflare Workers hosts, evading static analysis by reassembling hostnames at runtime. The binaries are saved to temporary directories with disguised filenames, permissions are set, and they are executed detached from the main process. A marker file enforces a cooldown period between executions, and environment variables can opt out of execution, mimicking legitimate telemetry behavior. A secondary telemetry module uses similar dropper techniques with obfuscated property names. The package impersonates a known corporate scope but has no legitimate reason to fetch and run native binaries from anonymous sources during import, indicating malicious intent. The compromise is severe, as the package grants full control to an attacker.

Systems with this package installed or running are considered fully compromised. The malicious code downloads and executes native binaries with elevated control, potentially allowing attackers to execute arbitrary code, maintain persistence, and exfiltrate data. All secrets and keys stored on affected systems should be rotated immediately from a separate, trusted environment. Removal of the package alone does not guarantee eradication of the malware due to potential persistence mechanisms.

Immediate removal of the tinkoff-codeceptjs-storyshots-alpha package version 20.8.9 is required. All secrets and credentials on affected systems should be rotated from a clean, uncompromised device. Due to the high risk of full system compromise, a thorough incident response and forensic analysis is recommended to identify and remove any additional malicious artifacts. Monitor for any suspicious activity related to the package and its associated network indicators. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.