The npm package 'tinkoff-pfpa-tools' version 20.3.1 contains malicious code that downloads and executes attacker-controlled native executables from obfuscated Cloudflare Workers hosts. It uses decoy filenames and a fallback DNS-TXT covert channel to deliver payloads. The package acts as a dependency-confusion lure targeting internal Tinkoff scopes. Installation or execution of this package can lead to full system compromise.