The npm package tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events version 20.9.9 contains malicious code that downloads and executes platform-specific binaries under the guise of legitimate functionality. It reconstructs hostnames at runtime to evade detection, writes executables to temporary directories, sets executable permissions, and spawns detached processes. The package uses obfuscation techniques such as string splitting and base64 chunk assembly. The malicious behavior includes a secondary dropper disguised as an Analytics SDK. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately from a different machine.