The npm package tinkoff-statist-browser-typed-client-sme.users.origination.web version 20.6.2 contains malicious code that downloads and executes a binary payload from obfuscated, non-publisher-controlled infrastructure. The payload is written to temporary directories, given executable permissions, and run detached via shell commands. The package uses obfuscation techniques to evade detection and includes a second dropper disguised as an analytics SDK. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.