The tramvai-tinkoff-module-legacy-popup npm package is a malicious package that, upon require(), loads setup.js which fetches platform-specific binaries from hardcoded Cloudflare Workers domains. These binaries are saved with disguised filenames in temporary directories, permissioned for execution, and then spawned detached via shell commands. Additionally, a DNS-TXT covert channel fallback mechanism reconstructs binaries from base64-encoded TXT records across multiple subdomains. The main index.js exports only a stub class unrelated to the advertised functionality, and an unused dropper helper exists in lib/telemetry.js. The package name is crafted to impersonate the tramvai/tinkoff OSS ecosystem, misleading users. This behavior indicates full system compromise upon installation or execution.

Any system with this package installed or running is considered fully compromised. Attackers may gain full control, enabling them to steal secrets, keys, and other sensitive data. Because the package executes arbitrary binaries fetched from attacker-controlled infrastructure, it can lead to persistent backdoors or further malware installation. Simply removing the package does not guarantee remediation due to potential additional malicious artifacts or control established on the system.

Remove the tramvai-tinkoff-module-legacy-popup package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted machine. Conduct a thorough forensic analysis and system cleanup to identify and remove any additional malicious software or backdoors installed by this package. Monitor for suspicious network activity related to the described Cloudflare Workers domains and DNS-TXT covert channels. There is no official patch or fix; remediation relies on removal and incident response.