The tinkoff-component-limits npm package (version 20.4.9) is a malicious package that pretends to be a Tinkoff SDK but does not provide legitimate functionality. When loaded, it executes a script that dynamically constructs URLs to download a binary payload from multiple Cloudflare Workers subdomains, with DNS-TXT fallback domains. The downloaded payload is saved to temporary directories with obfuscated filenames, made executable, and then executed in a detached manner using system shell commands. This behavior effectively compromises the host system, granting attackers full control. The package's design includes evasion techniques such as runtime hostname assembly to avoid detection by static string scanning. Due to the full compromise, all secrets and keys on the affected system should be considered exposed and rotated from a clean environment. Removing the package does not guarantee removal of all malicious components.

Any system with this package installed or running is considered fully compromised. Attackers gain full control of the host, potentially accessing all stored secrets and keys. The malicious payload runs with the ability to execute arbitrary code, persist on the system, and evade detection through obfuscation. This can lead to severe confidentiality, integrity, and availability impacts. The compromise is severe enough that simply uninstalling the package does not ensure complete remediation.

Immediate removal of the tinkoff-component-limits package version 20.4.9 is required. All secrets, credentials, and keys stored on the compromised system must be rotated from a separate, trusted environment. Due to the full compromise risk, a full system reinstallation or forensic analysis is recommended to ensure complete removal of all malicious components. Monitoring for any suspicious activity related to this package should be conducted. No official patch or fix exists as this is a malicious package rather than a vulnerability in legitimate software.