The npm package tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events version 20.1.8 contains malicious code that executes attacker-controlled payloads upon installation. It fetches and executes binaries from attacker-controlled Cloudflare Workers endpoints, disguises them as system diagnostic components, and runs them with elevated permissions. This results in full compromise of the host system where the package is installed.