The tinkoff-component-infopanel npm package (version 20.8.3) includes malicious functionality in its _platform.js file that downloads a native binary from dynamically assembled Cloudflare Workers URLs, using DNS-TXT fallback for resolution. This binary is saved to a masqueraded cache path with misleading filenames, given executable permissions, and executed detached via shell commands. The package executes this dropper immediately upon being required (top-level require in index.js), leading to full compromise of the host system. The package falsely impersonates the Tinkoff brand, declares no author or repository, and is labeled as an 'internal' module in its README. No cryptographic verification of the downloaded binary is performed, increasing risk. Systems with this package installed should be considered fully compromised, requiring secret/key rotation and comprehensive remediation.

Any system with this package installed or running is considered fully compromised, as the package downloads and executes arbitrary native code with no integrity checks. This can lead to complete attacker control over the host, including access to secrets and keys. Removal of the package alone may not remove all malicious artifacts or backdoors introduced by the executed binary.

Immediate removal of the tinkoff-component-infopanel package version 20.8.3 is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted environment. Due to the high likelihood of persistent compromise, a full system investigation and remediation is recommended. Patch status is not confirmed; no official fix or vendor advisory is available. Users should avoid installing this package and verify dependencies for malicious code.