That's correct, it's exfiltrating data from the developer machine