03:03 in the morning, and a file appeared on my machine that I never asked for.

I had typed exactly one command: npm install . The repo was my own sandbox, built five minutes earlier, and its package.json carried a single preinstall script that wrote a marker file with a timestamp. One second later marker-npm.txt sat in the folder, stamped 2026-11-11T21:03:01.183Z . I had not read a line of the code. I had not run anything inside it. The install step ran it for me.

That was the whole point of the night: find out how many ways a cloned repo can run code on your machine before you read a single line of it. I built a sandbox repo with five execution surfaces, every one of them harmless, every one writing nothing worse than a timestamped text file, and I ran each while saving the terminal output. Two of the five fired on install alone. A third fired the moment I typed its name. The last two never fired at all. The split between those groups is the whole story.

The timing was not random.…