The npm package tramvai-tinkoff-module-legacy-popup contains malicious code that downloads and executes platform-specific payloads from Cloudflare Workers hosts. It uses obfuscated domain names and masquerades the payloads with benign filenames before execution. The package also implements a DNS-TXT record covert channel to fetch and reconstruct binaries. The package name impersonates a legitimate Russian-language OSS ecosystem. Installing or running this package compromises the host system, potentially exposing all stored secrets and keys.