The path where he claimed to have found malware was like this
/tmp/.temp_mount_<MOUNT_ID>/var/lib/docker/overlay2/<LAYER_HASH>/diff/home/discourse/.cache/yarn/v6/npm-lefthook- windows-arm64--<PACKAGE_HASH>-integrity/node_modules/lefthook-windows-arm64/bin