This malicious npm package unconditionally requires a loader script that fetches a platform-specific executable from Cloudflare Workers endpoints, with a DNS TXT fallback mechanism to evade detection. The executable is written to temporary directories under decoy filenames, given executable permissions, and spawned detached via shell commands, granting remote operators arbitrary code execution capabilities. The package name is crafted to resemble legitimate internal Tinkoff namespaces, indicating a targeted typosquatting attack. Any system with this package installed or running is at high risk of full compromise.

Any computer with this package installed or running is considered fully compromised, as the attacker gains arbitrary code execution capabilities. This can lead to theft of secrets and keys stored on the system, unauthorized control, and persistent malicious activity. Removal of the package alone does not guarantee eradication of all malicious software introduced by the attacker.

Immediate removal of the malicious package is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted computer. Due to the high risk of full system compromise, a thorough security assessment and potential system rebuild are recommended. No official patch or fix is available; remediation relies on removal and secret rotation.