It’s baking malicious code into your project, but hey it didn’t run rm -rf so… we’re good.