ONE FINDING, PLOTTED
Read one row at a time, nothing here is unusual.
Packages read files. Build tools run gzip. Installers write to temporary directories. What makes this a finding is the order the actions happened in, visible only while the code is running.
polymarket-stake-mathss@3.5.2 · 2 KB · ONE POSTINSTALL HOOK
REVIEW
Nothing was taken. The container holds nothing real and is destroyed moments later, so what the package collected was a set of files that exist nowhere else.
ATTRIBUTION
An install is noisy. Only some of the noise is the package.
Every recorded action is tied back to the process that produced it. npm reads your .npmrc on every install; that is npm doing its job, not a finding.
PROCESS TREE · SINGLE RUNPID
npm install 1 ├── npm 12 │ ├── openat /root/.npmrc │ ├── stat /usr/lib/node_modules │ ├── write ./node_modules/.package-lock.json │ └── connect registry.npmjs.org:443 └── postinstall → node 31 ├── openat /root/.ssh/id_rsa ├── openat /root/.aws/credentials ├── openat /root/.electrum/wallets/default_wallet ├── execve /usr/bin/tar ├── execve /usr/bin/gzip ├── write /tmp/.x/ssh.gz └── connect 216.198.79.1:443
npm and build tooling, expected, discarded
package code, kept, then correlated
READING THE FEED
Two verdicts, deliberately
A third tier invites arguments about which shade something is instead of whether to look at it. Where a run was cut short, the result is review, because no coverage is not the same as nothing found.
REVIEW
Behaviour a human should look at. A lead, not a conviction.
CLEAN
Nothing notable observed. Behaviour outside the observation window is out of scope.