A Windows Trojan documented in late 2025 is a reminder that in modern development, project files can become attack surface, not just configuration.