L0Psec
We will just pivot off the domain. The domain observed in the script above (vscode-bootstrap\.sh) is already being detected on VT and appears linked to beavertail. There another interesting script here called post-checkout from a githooks directory. Let's take a look at that.
