The npm package tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci version 20.1.2 contains malicious code that downloads and executes a platform-specific executable from external Cloudflare Workers endpoints. The executable is saved under disguised filenames and executed detached from the main process. The package uses obfuscation techniques to evade static analysis and includes environment variables to opt out of telemetry. This package is a typosquatting attempt targeting an internal Tinkoff client namespace, indicating a supply-chain compromise. Any system with this package installed should be considered fully compromised.