[nitrogen]

If a .js file is redirected to from a web page, with a Content-Disposition header marking it as a download, and (as is common) the browser downloads automatically to ~/Downloads, doesn't that leave the .js file in a predictable place that can then be used by an attack on Electron?

[bjoli]

that could probably.be answered by jlund. Electron downloading things by default seems like a pretty bad thing to do.