IMO the solution here is to build this as an osquery extension rather than bundle it in core.