The npm package tinkoff-fb-fieldset-car-reference-kasko version 20.7.7 contains malicious code that executes immediately upon module load. It downloads and runs a platform-specific binary from attacker-controlled Cloudflare Workers hosts, saving it to temporary directories under deceptive names and executing it without verification. This results in arbitrary code execution on the host system. Any system with this package installed should be considered fully compromised, and secrets should be rotated from a clean environment.