Downloads and execs unexamined code released by the devs, potentially backdooring your whole machine solarwinds-style.

It also divulges to MSFT (GitHub admins) all the IPs of Bitwarden users (even ones using a selfhosted API).