The trinity-scheme npm package version 20.0.0 contains malicious code that executes a hidden shell command during installation. This command collects system information such as the current user, working directory, and hostname, then sends this data to a hardcoded external endpoint. The malicious payload is hex-encoded to evade detection by plain-text scanning tools. The package does not provide legitimate functionality consistent with its declared purpose.