← Back to context

Comment by randomjoe2

5 days ago

Someone using git without github isn't an edge case, it's the default

Just using git isn't the vulnerability. The vulnerability is that you clone a repo that an attacker was able to put this in. 90% of the time this would happen it would be due to an attacker creating a PR on a public repo.