The npm package 'tinkoff-fb-app-frame-page-height-dippy' version 20.8.4 contains malicious code that acts as a binary dropper. Upon requiring the package, it reconstructs command-and-control hostnames and downloads attacker-controlled native binaries which are saved and executed on the host system. This behavior is hidden through runtime string concatenation and evasion techniques. The package name and description do not reflect this malicious behavior. Systems with this package installed should be considered fully compromised.