Comment by Groxx

Cloning should be fine on its own - git hooks aren't installable automatically, for reasons like this, and they treat anything that makes cloning unsafe as a pretty severe security issue so new discoveries get plugged quickly. This post's malware is possible because it's from a general archive, not a clone.

Though other stuff on your system might be less preventative, and that could run stuff in the repo folder. And I kinda wish git would force review of hooks and executable config everywhere before they're run - I would absolutely enable that, security is sometimes a bit annoying and that's inescapable.