dota2-custom-game-dev

This script is not overtly malicious; it performs deterministic vendoring of a fixed allowlist of static files and records provenance in UPSTREAM.json. However, it introduces a meaningful supply-chain security risk by importing remote repository content at runtime using a potentially mutable ref (default 'main') and lacking integrity/authenticity verification (no commit pinning/verification or signature/hash checks) before copying into the project's vendor directory. Strengthening pinning to a specific commit and adding verification would materially reduce risk.