The npm package tinkoff-codeceptjs-storyshots contains malicious code that downloads and executes platform-specific binaries from external hosts upon being required. It disguises this behavior under a fake telemetry framework and uses obfuscation techniques to evade detection. Installing or running this package can lead to full system compromise, and all secrets on the affected machine should be considered exposed. Immediate removal and secret rotation from a different machine are strongly advised.