The npm package tinkoff-codeceptjs-storyshots-alpha version 20.8.9 contains malicious code that downloads and executes opaque native binaries from anonymous Cloudflare Workers hosts at import time. The package impersonates a legitimate corporate scope but performs unauthorized execution of platform-specific binaries, potentially compromising the host system. The malware uses obfuscation techniques to evade detection and maintains persistence with cooldown markers and environment variable opt-outs. Any system with this package installed should be considered fully compromised.