“Executing this series of keypresses prompts the built-in Windows Powershell to download password-stealing malware.”
The fake GitHub alert sends developers to a CAPTCHA that asks for Windows+R, Ctrl+V and Enter. That pastes a PowerShell command that fetches Lumma Stealer. Programmers mostly won’t fall for it. Everyone else has never heard of PowerShell, and Microsoft says don’t disable it, so it ships armed on every PC.