The npm package delivery-ci-validate-tinkoff-fb version 35.6.9 contains malicious code that executes automatically upon import. It downloads and runs a platform-specific binary from dynamically assembled command-and-control hostnames without integrity checks, disguising the binary as a legitimate Microsoft diagnostic tool. The package uses filesystem markers and telemetry-like naming to evade detection. The exported validate() function is a benign stub unrelated to the malicious activity.