The npm package bytepack-probe-a7x3 versions 1.0.0 and 1.0.1 declare a dependency on a package named leak-internal, which is fetched from an external HTTPS tarball URL rather than a standard registry. This tarball is retrieved without version pinning, integrity verification, or signature checks, allowing arbitrary code execution during npm install. The external URL and dependency name suggest the payload is designed to perform internal network probing, potentially leaking sensitive information.