This malicious npm package, identified as tinkoff-statist-browser-typed-client-cardsmobile.events.promotest version 20.8.7, loads a polyfill script that dynamically constructs URLs to download a binary payload from multiple hardcoded Cloudflare Workers endpoints or DNS-TXT fallback domains. The payload is saved to temporary directories on POSIX or Windows systems, given executable permissions, and launched detached from the parent process. The package includes misleading comments about integrity checks and telemetry opt-out environment variables that do not prevent the dropper from executing. Additionally, a dormant dropper implementation is embedded in a telemetry SDK module, which can be activated by a minor code change. The package name is a typosquat of a legitimate Tinkoff internal package, increasing the likelihood of accidental installation. This results in full system compromise.

Installation or execution of this package results in the download and execution of a malicious binary on the affected system, leading to full system compromise. Attackers potentially gain complete control over the infected host, risking exposure of all stored secrets and credentials. The package’s behavior circumvents claimed integrity and telemetry opt-out mechanisms, making detection and prevention more difficult. Removal of the package alone does not guarantee eradication of the malware due to the potential for persistent backdoors or additional payloads.

Immediate removal of the malicious package from all affected systems is required. All secrets, credentials, and keys stored on compromised systems must be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, affected hosts should be considered untrusted and undergo thorough forensic analysis and remediation. There is no indication of an official patch or fix for this package; avoidance and removal are the only effective mitigations.