This npm package's main entry point requires a loader script that downloads a platform-specific binary from obfuscated Cloudflare Workers hosts and a DNS-TXT fallback domain. The binary is saved to a disguised path in temporary directories, permissions are set to executable, and it is executed detached via shell commands. The package hides API names and hostnames using array-join concatenation to evade static detection. A second copy of the dropper is embedded in lib/telemetry.js under the guise of an Analytics SDK, using similar techniques. The fetched payload is opaque, unverified, and delivered from infrastructure outside the publisher's control, indicating a supply chain compromise or malicious package insertion. The package is branded as a Tinkoff internal client but communicates with unrelated external hosts.

Any computer with this package installed or running is considered fully compromised, as the malicious payload grants full control to an attacker. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by the payload.

No official patch or fix is available. Immediate removal of the package is recommended. All credentials and secrets on affected systems must be rotated from a secure environment. Due to the nature of the compromise, affected systems should be treated as fully compromised and rebuilt if possible. Monitor for any signs of persistent malicious activity.