This is how npm-style RCE hacks happen by the way. You should all be vetting `dotnet-tools.json` and all MSBuild and PowerShell scripts.