magpie-trustoken-auth@0.3.17
Trustoken / AiPy for magpie — phone-code sign-in, the account's live model list, 灵石 balance, auto check-in and daily-task rewards. DeepSeek / Qwen / GLM / Doubao / Kimi / Hunyuan.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package defaults auto-check-in on, and that path can generate model requests that spend account quota without an explicit user request. This meets the automatic spending rule; the AiPy key's loopback use is otherwise consistent with the stated local-task feature.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Magpie invokes the enabled auto-check-in hook while daily tasks remain incomplete.
Impact
Unrequested model calls can spend account quota.
Mechanism
The hook creates forced AiPy tasks with a paid model; if that fails, it falls back to chat completion requests authenticated with the account API key.
Attack narrative
The package enables auto-check-in by default. When daily tasks are incomplete, the hook can create forced AiPy tasks using a nonzero-rate model; if local task creation fails, it sends fallback chat requests using the account API key. These unrequested calls can consume the user's quota.
AI rationale
The package defaults auto-check-in on, and that path can generate model requests that spend account quota without an explicit user request. This meets the automatic spending rule; the AiPy key's loopback use is otherwise consistent with the stated local-task feature.
Evidence
package.jsonsrc/hooks/checkin.mjssrc/aipy-local.mjssrc/api.mjssrc/rates.mjs%APPDATA%\aipy-pro\aipy (read for the local API key)
Network endpoints3
api.trustoken.cn/v1/chat/completionswww.trustoken.cn127.0.0.1:<AiPy port>/api/aipy/createTask
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- Package metadata enables `autoCheckin` by default.
- When daily tasks have gaps, the check-in hook creates AiPy tasks using the lowest-cost model.
- Task creation sends `force: true`, which can execute a new task in AiPy Pro.
- If local task creation fails, the hook sends chat requests with the account API key.
- The configured lowest-cost model has nonzero input and output rates.
Evidence against
- The manifest has no install, preinstall, or postinstall hook; the entry point assembles the plugin.
- The AiPy API key used for local task creation is sent to a loopback AiPy endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggedscripts/score.mjsView file
15import { join, resolve } from "node:path"
L16: import { spawnSync } from "node:child_process"
L17:
High
•matchType = normalized_sha256
matchedPackage = magpie-trustoken-auth@0.3.16
matchedPath = scripts/score.mjs
matchedIdentity = npm:bWFncGllLXRydXN0b2tlbi1hdXRo:0.3.16
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/score.mjsView on unpkgscripts/check.mjsView file
•matchType = normalized_sha256
matchedPackage = magpie-trustoken-auth@0.3.16
matchedPath = scripts/check.mjs
matchedIdentity = npm:bWFncGllLXRydXN0b2tlbi1hdXRo:0.3.16
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
13 High4 Medium4 Low
HighChild Processscripts/score.mjs
HighShell
HighSame File Env Network Executionsrc/aipy-local.mjs
HighSandbox Evasion Gated Capabilitysrc/hooks/methods.mjs
HighKnown Malware Source Similaritysrc/aipy-local.mjs
HighKnown Malware Source Similaritysrc/browser-login.mjs
HighKnown Malware Source Similarityscripts/release.mjs
HighKnown Malware Source Similarityscripts/check-magpie-stable.mjs
HighKnown Malware Source Similarityscripts/check.mjs
HighKnown Malware Source Similarityscripts/score.mjs
HighKnown Malware Source Similaritysrc/hooks/methods.mjs
HighKnown Malware Source Fingerprint Signature
Affected versions and remediation
This report applies to magpie-trustoken-auth@0.3.17.
See all versions of magpie-trustoken-auth for other recorded verdicts.
- Avoid installing magpie-trustoken-auth@0.3.17. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.