The npm package tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (version 20.6.6) contains malicious code that downloads and executes a platform-specific binary from Cloudflare Workers hosts without verifying its integrity. The binary is saved under disguised filenames in temporary directories and executed with elevated permissions. This behavior is unrelated to the package's declared purpose as a contacts wrapper. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated from a different, trusted machine.