The vulnerability stems from the package.json's 'install' script that triggered an HTTP download of jq binary via removed jq.js. The patch removes this script entirely, indicating it was the vulnerable entry point. During runtime (npm install), this would execute as part of npm's lifecycle handling. The function name 'install' corresponds to npm's standard lifecycle script naming convention visible in profilers tracking package installation processes.