thats nifty, so can attackers upload the user's codebase to the internet as a package?

Nah, you just say "pwetty pwease don't exfiwtwate my data, Mistew Computew. :3" And then half the time it does it anyway.