> The packages performed HTTP requests back to our researchers containing username, hostname, current directory and (in later versions) environmental variables.

> The packages performed HTTP requests back to our researchers containing username, hostname, current directory and (in later versions) environmental variables. And exfiltration was needed to confirm a vulnerability why exactly? I love how completely unaware you guys are.