You'll notice
Useful3 Signal2
Plugin approval prompts now escape hidden characters so a command cannot look harmless.
What's wrong with this entry?
Anonymous. No account, no email.
What
When a plugin marketplace supplies a command you are asked to approve, every non-printable and non-ASCII character is now shown as a \u{...} escape, and a warning is attached when anything was escaped. A command carrying hidden or control characters can no longer look harmless in the approval prompt.
Details
- The warning tells you the command contains escaped characters and to not proceed unless you expected them.
- Applies to the consent rendering path with no flag or setting behind it.
Evidence
Do not proceed unless you expected them.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.