The npm package tinkoff-pfp-block-mobile-advert-footer version 20.3.3 contains malicious code that, upon require(), silently loads a script which reconstructs attacker-controlled hostnames and downloads an unsigned platform-specific binary. This binary masquerades as a .NET diagnostic tool, is saved to temporary directories, made executable, and executed detached from the parent process. The package name impersonates legitimate internal tooling, but its only functional code is a dropper that facilitates remote code execution and persistence with anti-analysis evasion techniques. Any system with this package installed or running should be considered fully compromised.