The 'tinkoff-pfp-block-desktop-tabs' npm package (version 20.5.3) is malicious. Upon requiring the package, it loads a script that reconstructs endpoint hostnames and downloads platform-specific binaries via HTTPS. These binaries are saved under disguised names in temporary directories, given executable permissions, and executed detached from the main process. No hash or signature verification is performed on the downloaded binaries. A secondary module uses obfuscated code to perform similar actions. The package name falsely claims association with the Tinkoff brand. The dropped files mimic Microsoft diagnostic artifacts to blend in. This behavior results in full compromise of any system running the package.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, potentially accessing all secrets and keys stored on the system. Removal of the package alone does not guarantee eradication of all malicious components or persistence mechanisms.

Remove the 'tinkoff-pfp-block-desktop-tabs' package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted device. Due to the potential for full system compromise, consider rebuilding the affected system to ensure complete remediation. No official patch or fix is available; the package itself is malicious.