Comment by lgats

re #1: the email could link to a github pages site hosting the same malware...

re #2: it doesn't really have you typing into shell, 'just paste'