Pretending to be a code review exercise, they get you to clone a github repo and open it in vscode. There's some hooks in the vscide config in the repo that basically installs a Trojan which goes to work while they conduct the rest of the "interview"