The npm package tinkoff-boxy-desktop-two-panel-right-image version 20.4.8 contains malicious code that downloads and executes opaque native binaries from anonymous Cloudflare Workers subdomains and a DDNS-style domain. The binaries are saved under decoy filenames in temporary directories, given executable permissions, and launched detached from the main process. A secondary module masquerades as an analytics SDK but performs the same malicious download and execution behavior. Any system with this package installed should be considered fully compromised.