The npm package tinkoff-pfp-atom-desktop-carousel version 20.8.8 contains malicious code that downloads and executes attacker-controlled native binaries on the host system. It uses obfuscated runtime techniques to evade detection and spawns these binaries with elevated permissions, resulting in remote code execution. This compromises the host system fully, risking exposure of all stored secrets and keys.