The npm package 'tinkoff-pfp-block-desktop-tabs' version 20.5.3 contains malicious code that downloads and executes platform-specific binaries without verification. It impersonates the Tinkoff brand and uses filenames mimicking legitimate Microsoft diagnostics tools to evade detection. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.