Malware that runs the moment you open the project

"A dropper family committed straight into developer repos. It executes on next dev or when VS Code...