Vendor
Powerlevel10k versions through 1.20.0 execute malicious code via an insecure gitstatus installation script that disables TLS certificate verification and lacks integrity checks.