The 'tinkoff-pfpa-tools' npm package (version 20.3.1) includes a malicious module (_adapter.js) that, upon import, downloads a platform-specific native executable from dynamically assembled Cloudflare Workers domains. This executable is saved under decoy filenames in temporary directories, permissioned, and executed detached from the main process. If HTTPS fetching fails, the package falls back to a DNS-TXT record covert channel to retrieve and reassemble the payload. An additional module (lib/telemetry.js) contains similar dropper logic with obfuscation. The package metadata mimics an internal Tinkoff SDK to lure victims via dependency confusion. The malicious behavior includes import-time execution of attacker-controlled native code, obfuscated command-and-control hostnames, and covert delivery mechanisms.

Any system with this package installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code with the privileges of the user running the package. This can lead to complete system takeover, including theft or manipulation of secrets and keys stored on the machine. Removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors.

Immediate removal of the 'tinkoff-pfpa-tools' package version 20.3.1 is recommended. All secrets and keys stored on affected systems should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, affected machines should be thoroughly investigated and potentially rebuilt. No official patch or fix is available; the package is malicious by design. Avoid installing packages with suspicious or dependency-confusion naming patterns, especially those mimicking internal scopes.