Whoever knows the URL, can access the work. So, in theory, a threat actor can run a Python web server, upload malware to the Codespace, open a web server port, and set the visibility as “public”.

Every Codespaces environment lives in its own VM and has an isolated virtual network. However, developers can choose to use a feature called port forwarding to share preview links to their ...

GitHub Codespaces, a cloud-hosted integrated development environment (IDE), has a port forwarding feature that malicious actors can abuse to host and distribute malware to unaware developers.