The package tinkoff-pfp-atom-desktop-carousel (npm) version 20.8.8 is malicious. Upon requiring the package, it loads a loader script that selects a platform-specific asset and downloads a native binary from randomized Cloudflare Workers hosts and fallback DNS-TXT base64 encoded sources. The binary is saved to temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. The package uses runtime string reconstruction to evade static analysis. A second dropper with similar functionality is embedded in telemetry.js. This results in remote code execution on the installer's host. The package name impersonates a Tinkoff Bank internal scope to deceive users. Installing or running this package fully compromises the host.

Any system with this package installed or running should be considered fully compromised. The attacker gains remote code execution capabilities, allowing arbitrary code execution with the installer's privileges. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or persistence mechanisms.

Immediate removal of the package tinkoff-pfp-atom-desktop-carousel version 20.8.8 is required. All secrets and keys on the affected system must be rotated from a different, trusted machine. Due to the nature of the compromise, a full system reinstallation or forensic analysis is recommended to ensure complete eradication of malicious code. No official patch or fix is available; the package itself is malicious and should not be used.