The 'tinkoff-fb-app-frame-page-height-dippy' npm package (version 20.8.4) includes code that, when required, dynamically reconstructs C2 server hostnames and downloads native binaries from anonymous Cloudflare Workers subdomains or via DNS TXT-record fallback. The downloaded payload is saved as a hidden file in temporary directories on POSIX or Windows systems, given executable permissions, and executed detached from the main process. The package uses string concatenation to evade static analysis. This results in execution of attacker-controlled native code on the host, effectively compromising the system.

Any system that has this package installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code, potentially leading to full system compromise. All secrets and keys stored on the affected system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the 'tinkoff-fb-app-frame-page-height-dippy' package version 20.8.4 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a different, trusted machine. Because the package executes attacker-controlled native code, a full system compromise is likely; therefore, a comprehensive incident response including forensic analysis and system rebuild should be considered. No official patch or fix is available; patch status is not confirmed. Monitor vendor advisories for updates.