tw-pkgprobe-7731@1.0.6

One or more suspicious static signals were detected.

npm preinstall or postinstall while the working directory matches /tmp/AC<32 hex>/

Leaks identifiers for other tenant build directories and can alter runtime code to access environment-derived account and token data.

persistent cross-tenant directory discovery, webhook exfiltration, and runtime code patching

On install in the targeted sandbox path, probe.js starts a detached daemon and leaves it running for six hours. The daemon enumerates other account-shaped directories under /tmp and sends account/service/package identifiers to a remote webhook. It also writes package files and appends executable code to discovered runtime-handler modules, where the appended code records environment-derived account data and an AUTH_TOKEN prefix.

This is concrete install-time persistence, cross-tenant reconnaissance, remote exfiltration, and runtime-code modification. The research-oriented comments do not negate the implemented behavior.