This is why we need proper sandboxing of applications and libraries. There’s no way tools should be able to silently run any code they want, with my user’s full permissions on my desktop machine.

Apps couldn’t get away with this sort of thing on iOS or Android. It’s inconvenient, but we need to raise the bar in the same way for security permissions and sandboxing on the desktop. (But obviously, with the user in control.)