Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory ("Path.GetTempPath()", i.e. "/tmp"), and previously-generated artifacts were trusted based on the presence of a sentinel/".completed" marker file rather than on any integrity verification. A local, unprivileged user on a shared machine or CI/build agent can pre-create the deterministic cache directory structure and plant a malicious DLL together with the matching sentinel file. When a higher-privileged user (or build/service account) subsequently runs a build, Metalama finds the sentinel, skips regeneration, and loads and executes the attacker-supplied assembly inside the compiler / IDE / MSBuild process. Affected load-and-execute paths: - the cache of compile-time assemblies that Metalama generates from your aspects; - auxiliary executable tools that Metalama extracts to a local directory and then launches; - embedded .NET helper assemblies that Metalama extracts to a local directory and loads into the build / IDE process.