Post #1991167

seems hard to get past the first step (or really 3) of this attack though: getting someone to clone & open in VSCode & trust a random repo? Even if you don’t trust it, before long you’re probably running some of the arbitrary code inside manually?