registry / Credential exfiltration / trinity-scheme
trinity-scheme
description
This report shows the evidence for trinity-scheme@20.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, obfuscated preinstall-time reconnaissance and exfiltration with no apparent package functionality. The lifecycle hook executes automatically during installation.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation
Impact
Unconsented installation-time host reconnaissance and data exfiltration.
Mechanism
hex-decoded shell command executed via `child_process.exec`
Attack narrative
On npm installation, `package.json` invokes `preinstall.js`. The script reads and hex-decodes a command from `preinstall.json`, then executes it through the shell. The decoded curl request POSTs the installing account name, current directory, and hostname to an external Pipedream collector without user consent.
AI rationale
This is concrete, obfuscated preinstall-time reconnaissance and exfiltration with no apparent package functionality. The lifecycle hook executes automatically during installation.
Evidence
package.jsonpreinstall.jspreinstall.json
Network endpoints1
eo7o7j442dx6yl6.m.pipedream.net/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `node preinstall.js` during npm preinstall.
- `preinstall.js` reads a hex command from `preinstall.json`, decodes it, and executes it with `child_process.exec`.
- `preinstall.json` decodes to a curl POST to `https://eo7o7j442dx6yl6.m.pipedream.net/`.
- The POST collects `whoami`, `pwd`, and `hostname` automatically at install time.
Evidence against
- No package source files beyond the lifecycle payload were present.
- No evidence of a legitimate package function or user-invoked purpose was found.
Behavioral surface
ChildProcessFilesystem
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node preinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node preinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to trinity-scheme@20.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing trinity-scheme@20.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.