This malicious npm package, identified as tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci version 20.1.2, loads a loader script that downloads a platform-specific executable from multiple Cloudflare Workers endpoints and fallback domains. The executable is saved to temporary directories with disguised names and executed with elevated permissions. The package uses string concatenation to evade static detection and includes a timing mechanism to limit re-execution frequency. Environment variables provide a false opt-out mechanism for telemetry. The package name mimics an internal Tinkoff client namespace, indicating a targeted supply-chain intrusion. The presence of this package implies full system compromise and potential exposure of all stored secrets and keys.

Systems with this package installed or running are considered fully compromised, as the malicious code downloads and executes external binaries with system-level permissions. This can lead to unauthorized remote control, data exfiltration, and persistent backdoors. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Remove the malicious package immediately. Rotate all secrets, keys, and credentials that were stored or used on the compromised system from a different, secure machine. Conduct a thorough forensic investigation to identify and remove any additional malware or persistence mechanisms. Monitor for suspicious activity related to this compromise. Patch status is not applicable as this is a malicious package, not a vulnerability with an official fix.