This malicious npm package masquerades as a legitimate internal Tinkoff package but instead downloads a native binary payload from multiple hardcoded remote hosts. The payload is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. If the primary HTTPS download fails, the package uses a DNS TXT record covert channel to reconstruct and execute the payload. Runtime string assembly is used to evade static detection. The package's declared functionality is inconsistent with its behavior, indicating a dependency confusion or typosquatting attack vector.

Any system with this package installed or running is considered fully compromised. The attacker gains execution of arbitrary native code, which can lead to complete system control. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation. Removal of the package alone does not guarantee eradication of the malicious payload or persistence mechanisms.

Immediate removal of the package 'tinkoff-statist-browser-typed-client-sme.compliance.web.events' version 20.4.4 is required. All secrets and keys stored on the compromised system must be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a full forensic investigation and system rebuild are recommended. No official patch or fix is available; remediation relies on removal and secret rotation.