magpie-trustoken-auth@0.3.6
Trustoken / AiPy for magpie — phone-code sign-in, the account's live model list, 灵石 balance, auto check-in and daily-task rewards. DeepSeek / Qwen / GLM / Doubao / Kimi / Hunyuan.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically creates and runs model tasks during check-in, which can consume the user's quota without per-task consent. The tasks are tied to the advertised reward flow and use a local AiPy endpoint, but the automatic resource spending meets the malicious-action rule.
Static reason
One or more suspicious static signals were detected.
Trigger
Magpie invokes the plugin's check-in hook while autoCheckin is enabled, and the account has incomplete daily tasks.
Impact
Unrequested model activity may consume account quota or incur usage costs while attempting to earn daily-task rewards.
Mechanism
The hook reads the account credentials, calculates the missing task count, then calls the local AiPy task API with force:true and the cheapest model to create sessions.
Attack narrative
With auto-check-in enabled by default, the check-in hook detects incomplete daily tasks and creates AiPy sessions using the local AiPy API. Those sessions perform model work and can consume the user's quota without a separate request for each task.
AI rationale
The package automatically creates and runs model tasks during check-in, which can consume the user's quota without per-task consent. The tasks are tied to the advertised reward flow and use a local AiPy endpoint, but the automatic resource spending meets the malicious-action rule.
Evidence
package.jsonindex.mjssrc/hooks/checkin.mjssrc/aipy-local.mjs
Network endpoints2
127.0.0.1:<AiPy port>www.trustoken.cn
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package enables magpie auto-check-in by default.
- The check-in hook checks for incomplete daily tasks and automatically calls ensureAipyTasks to create AiPy sessions.
- Each created session sends force:true and a model to AiPy's local task API; the hook chooses the cheapest model, but still triggers model work that can consume the user's quota.
- The hook is wired into the plugin and obtains the current account credentials before performing check-in actions.
Evidence against
- The task creation is limited to reported gaps in Trustoken daily tasks.
- The request is sent to a loopback AiPy endpoint using the local AiPy API key, rather than sending that key to a remote host.
- The package presents itself as a Trustoken/AiPy plugin for check-in and daily-task rewards.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
4 flaggedscripts/score.mjsView file
15import { join, resolve } from "node:path"
L16: import { spawnSync } from "node:child_process"
L17:
High
scripts/check.mjsView file
75"type 是 module",
L76: "magpie 用 import() 加载，commonjs 会失败")
L77:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/check.mjsView on unpkg · L75src/aipy-local.mjsView file
3// 2026-10-29 实测：
L4: // · `POST http://127.0.0.1:<AiPy 端口>/api/aipy/createTask`（body 是参数数组）
L5: // · `{force:true, title, instruction, model}` → 新建一个任务（会话）并执行
...
L10:
L11: import { execSync } from "node:child_process"
L12: import { existsSync } from "node:fs"
...
L18: export function aipyDbPath() {
L19: const base = process.env.APPDATA || (process.env.USERPROFILE ? path.join(process.env.USERPROFILE, "AppData", "Roaming") : "")
L20: return base ? path.join(base, "aipy-pro", "aipy") : ""
Findings
4 High4 Medium4 Low
HighChild Processscripts/score.mjs
HighShell
HighSame File Env Network Executionsrc/aipy-local.mjs
HighSandbox Evasion Gated Capabilitysrc/hooks/methods.mjs
MediumDynamic Requirescripts/check.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to magpie-trustoken-auth@0.3.6.
See all versions of magpie-trustoken-auth for other recorded verdicts.
- Avoid installing magpie-trustoken-auth@0.3.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.