MAL-2026-10425

    Dashboard / Malicious Package / MAL-2026-10425

    MAL-2026-10425

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in trinity-scheme (npm)

    Details: Source: amazon-inspector (5d576c0487668f599137a479e17ddc1335935fdec631f7d5adfa9e73049d7652) On npm install, the package's preinstall lifecycle reads a hex-encoded `command` string from preinstall.json, decodes it via Buffer.from(..., 'hex'), and passes the decoded shell command to child_process.exec. The decoded payload collects the installer's `whoami`, `pwd`, and `hostname` output and POSTs the values to the hardcoded endpoint https://eo7o7j442dx6yl6.m.pipedream.net/. The command is stored in hex form to evade plain-text scanning; the package otherwise provides no functionality consistent with its declared name.

    References: https://www.npmjs.com/package/trinity-scheme/v/20.0.0

    Affected packages

    Package

    Name: trinity-scheme

    Purl: pkg:npm/trinity-scheme

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    20.0.0
    MAL-2026-10425 | CVE-DB