The npm package tinkoff-test-app-child-app version 20.3.8 contains malicious code that downloads and executes platform-specific binaries from untrusted external servers without integrity verification. It disguises these binaries under temporary filenames, sets executable permissions, and runs them detached from the main process. The package also includes a telemetry-like module that uses similar techniques to drop and execute malicious payloads. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated immediately.