It's more than just dotfiles, because it's pretty much impossible to have RCE from a USB device name just from dotfiles. It's dotfiles and bunch of scripts of very questionable quality bsky.app/profile/sele...
this is your amazing linux "distro" on no DEI
github.com
[Security] Stop USB device names from being executed as Hyprland Lua by acrogenesis · Pull Request #8129 · basecamp/omarchy
A HID gadget can put an arbitrary string in the USB product/device name Hyprland reports. omarchy-toggle-input-device interpolated that name into hyprctl eval and into a generated Lua file under ~/...