The security tool you cloned from GitHub ran before you built it. 2,000 PCs paid.

Researchers at Doctor Web found GitHub repositories posing as scanning, testing and log analysis tools, such as a parser for Fscan output. Malicious code sat behind long runs of whitespace in Visual Studio, Python and Go files, and some Visual Studio projects ran it in a pre-build event. More than 2,000 Windows systems are compromised so far, per BleepingComputer.

You clone a handy script, open the project and hit build. That one click can install AsyncRAT, a clipboard clipper that swaps crypto addresses, and a stealer that takes browser data, VPN settings and Discord tokens.

Before you build any cloned tool, open its project files and look for pre-build events and lines that run off the right edge of the screen. Build unknown repos in a throwaway VM.