Critical flaw in new tool could allow attackers to steal data at will from developers working with untrusted repositories.