The dangerous part is how routine it feels.
A repo is shared. The candidate is asked to run it. One `npm install` can expose SSH keys, cloud credentials, browser sessions, env vars, or crypto wallets.
This is why suspicious coding tests should be checked before they are run.