The malicious npm package tinkoff-pfp-block-mobile-advert-footer (version 20.3.3) executes a multi-stage attack upon being required. It reconstructs attacker-controlled hostnames from fragmented strings and uses DNS-TXT records with base64 encoding as a fallback to download an unsigned binary over HTTPS. This binary is stored in temporary directories on Unix or Windows systems, given executable permissions, and launched detached from the parent process using shell commands. The package name is designed to impersonate Tinkoff internal tooling, but its actual functionality is limited to acting as a dropper for the malicious binary. The use of hostname reconstruction and DNS-TXT payload transport are deliberate anti-analysis evasion techniques. The presence of this package indicates a full system compromise, with potential unauthorized access to secrets and keys.

Systems with this package installed or running are considered fully compromised. The attacker gains the ability to execute arbitrary unsigned binaries on the host, potentially leading to full system control. Secrets and keys stored on the compromised system may be exposed or stolen. Removing the package alone does not guarantee removal of all malicious components or backdoors, as the attacker may have established persistent access.

Immediate removal of the tinkoff-pfp-block-mobile-advert-footer package version 20.3.3 is recommended. However, due to the high likelihood of full system compromise, all secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Incident response should assume complete attacker control and include thorough system investigation and remediation. No official patch or fix is available; remediation relies on removal and recovery procedures.