Malware in tinkoff-statist-browser-typed-client-sme.compliance.web.events

A malicious npm package named tinkoff-statist-browser-typed-client-sme.compliance.web.events was identified and reported via GitHub Security Advisory GHSA-9gx3-gv84-hwmg on August 5, 2026.\n\nAccording to the advisory, any computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems.\n\nImmediate action is required: all secrets and keys stored on compromised computers must be rotated from a different, unaffected system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the compromise.