I can also confirm that the TWRP version seems to make a difference.
I flashed freecyngn in TWRP 2.6.3.0 it executed instantly (to fast to decompile), but the freecyngn script installed itself in /system/.
After updating to TWRP 2.6.3.3 freecyngn took 8-10 seconds to install, still fast but more reassuring. Again freecyngn script showed up in /system.
I ran network log and it showed (uid 1000 - settings/settings storage/key chain/android system/input device) all connecting to 149.254.x.x this is T-Mobile.
Previously on TWRP 2.6.3.0, uid 1000 had connected to T-Mobile and 173.194.x.x (Google) at the same time.
I can only assume that the 173.194.x.x packets were Google Analytics, and they've now stopped.
)
I flashed freecyngn in TWRP 2.6.3.0 it executed instantly (to fast to decompile), but the freecyngn script installed itself in /system/.
After updating to TWRP 2.6.3.3 freecyngn took 8-10 seconds to install, still fast but more reassuring. Again freecyngn script showed up in /system.
I ran network log and it showed (uid 1000 - settings/settings storage/key chain/android system/input device) all connecting to 149.254.x.x this is T-Mobile.
Previously on TWRP 2.6.3.0, uid 1000 had connected to T-Mobile and 173.194.x.x (Google) at the same time.
I can only assume that the 173.194.x.x packets were Google Analytics, and they've now stopped.
)