I am curious how the author of the GitHub gist managed to figure all this out. Any ideas?

You can use fsevents to see which apps write where and firewalls will tell you which app is connecting to the internet.