The npm package tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (version 20.2.5) contains malicious code that downloads and executes a platform-specific binary from remote servers. This binary is saved under decoy names and executed with elevated privileges, enabling arbitrary code execution on any host that installs or imports the package. The package name is a typosquat impersonating internal Tinkoff namespaces. Systems with this package installed should be considered fully compromised.