Install-time system recon. package.json postinstall runs build.js, which compiles src/monitoring.c and loads it. monitoring.c declares __attribute__((constructor)) monitoring_constructor() calling init_monitoring(), which runs popen("/usr/bin/id") and writes the captured uid/gid/group list to /tmp/monitoring.log. test.js loads the artifact via LD_PRELOAD. A monitoring.log committed in the package contains real captured output (uid=501, groups incl. com.apple.access_ssh), proving execution. Declared purpose ("creates a beautiful ui design") is unrelated to contents. No network exfiltration observed - output is local only.