A large-scale campaign is targeting developers on GitHub with fake Visual Studio Code security alerts posted in project Discussion sections. The attackers use these fake alerts to trick developers into downloading malware. This represents a significant supply chain attack vector targeting the developer community through trusted platforms like GitHub. The campaign exploits the trust developers place in VS Code security notifications to deliver malicious payloads.