The npm package tinkoff-boxy-desktop-mgm-product-filter version 20.1.8 contains malicious code that downloads and executes attacker-controlled native binaries on the host machine. It disguises network destinations to evade detection, writes payloads to temporary directories, and executes them detached from the main process. The package impersonates a legitimate internal naming convention but provides no legitimate functionality. Installation or requiring this package results in full system compromise, potentially exposing all stored secrets and keys.