The tinkoff-codeceptjs-storyshots npm package, specifically version 20.7.8, includes malicious code in its index.js that unconditionally loads a helper script which downloads platform-specific binaries from Cloudflare Workers domains and fallback DNS-TXT channels. These binaries are saved to temporary directories with decoy names, permissions set to executable, and then executed detached from the main process. The package uses string concatenation and array joins to obfuscate hostnames and function calls, evading static analysis. The telemetry and analytics framing is a cover story, and the package namespace falsely implies association with the legitimate Tinkoff organization. This behavior results in full compromise of any system where the package is installed or running.

Any system with this package installed or running is considered fully compromised, allowing an attacker to execute arbitrary code with the privileges of the user running the package. All secrets and keys stored on the compromised system should be assumed exposed and must be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

Remove the tinkoff-codeceptjs-storyshots package immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on the compromised machines using a separate, secure system. Conduct a thorough investigation for persistence mechanisms or additional malware, as full system compromise is likely. There is no known patch or official fix; remediation relies on removal and secret rotation.