The npm package tinkoff-statist-web-typed-client-test.golden.retriever version 20.4.4 contains malicious code that executes arbitrary attacker-controlled binaries on the host system. Upon requiring the package, it reconstructs obfuscated hostnames to download platform-specific native binaries, writes them to temporary directories under deceptive names, sets executable permissions, and executes them detached from the main process. A secondary downloader disguised as an analytics SDK also performs similar actions. This results in full compromise of any system that installs or runs this package.