The npm package tinkoff-ui-action version 20.5.7 contains malicious code that downloads and executes platform-specific native binaries from obfuscated Cloudflare Workers subdomains and fallback domains without user consent or verification. This behavior is disguised within a React UI component library, making it unexpected and dangerous. The package writes these binaries to temporary directories, sets executable permissions, and runs them detached from the main process. A secondary payload runner is also present under an 'Analytics SDK' cover, further enabling malicious activity. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately from a separate, clean device.