The trinity-scheme package on npm, specifically version 20.0.0, includes a preinstall script that reads a hex-encoded command from a file named preinstall.json. This command is decoded and executed via child_process.exec, resulting in the collection of the installer's 'whoami', 'pwd', and 'hostname' outputs. These details are then exfiltrated via an HTTP POST request to a hardcoded URL (https://eo7o7j442dx6yl6.m.pipedream.net/). The use of hex encoding is intended to bypass plain-text scanning detection. The package itself lacks any legitimate functionality matching its name, indicating it is a malicious package designed for information theft.

The malicious code can lead to unauthorized disclosure of system information (user identity, current directory, hostname) to an external attacker-controlled server. This information leakage could facilitate further targeted attacks or reconnaissance. There is no indication of additional payloads or direct system compromise beyond information exfiltration in the provided data.

No official patch or remediation is currently documented for this package version. Users should avoid installing trinity-scheme version 20.0.0. Since this is a malicious package, removal and replacement with a trusted alternative is recommended. Monitor package sources carefully and verify package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.