git clone a repo, cd into the directory, git checkout ..., and you're compromised