They were magic creatures created to kill a specific person. The first were made from parts of animals and children. Non of these have ever been found because they were thrown into the sea to find their victim (They were dangerous to make though, because if the victim had stronger magical powers the tupilak would return and kill it's creator instead)
Later ones were made from wood that had been painted black, and often had parts from real animals or children in them, such as claws, teeth or eyes.
And finally there's the white tupilaks made from bone or stone. They were never meant to hurt anyone, but are simply meant for decoration, or even protection.
I like to think there's a story in here somewhere about the old tupilaks trying to sneak into a town and the new ones trying to keep them out.