The npm package tinkoff-boxy-mobile-vivid-heading version 20.7.5 contains malicious code that fetches and executes opaque native binaries from dynamically reconstructed Cloudflare Workers hosts and uses DNS-TXT record fallback channels to load additional payloads. The malicious code writes these binaries to temporary directories, sets executable permissions, and runs them detached from the main process. This behavior is disguised under a false 'device integration' purpose and includes a secondary module for telemetry that is not currently active. Installation of this package results in full system compromise, requiring immediate secret and key rotation and package removal.