Hackers target GitHub developers with fake VS Code alerts and CVEs, using malicious links to steal data and deliver malware.