The npm package tinkoff-fb-fieldset-car-reference-kasko version 20.7.7 includes a malicious dropper in its index.js that, upon loading, fetches an opaque binary payload from hardcoded Cloudflare Workers domains with DNS-TXT fallback hosts. The payload is saved to temporary directories with names mimicking legitimate .NET diagnostic tools, permissions are set to executable, and it is launched detached from the parent process. No integrity checks are performed on the downloaded binary. This leads to arbitrary attacker-controlled code execution on any system importing this package.

Systems that install or run this package version are subject to arbitrary code execution by attackers, resulting in full system compromise. Attackers may gain persistent control, access to secrets, and the ability to execute further malicious actions. Removal of the package alone does not guarantee eradication of the compromise due to potential persistence mechanisms.

Remove the malicious package immediately from all affected systems. Rotate all secrets and keys from a secure, uncompromised environment. Because the attacker may have full control of the system, consider rebuilding or thoroughly cleaning affected hosts. Monitor for any signs of persistence or additional malware. Patch status is not confirmed; check vendor advisories for updates or official remediation.