PolyMC’s maintainer has gone rogue and compromised the project, and there is a chance they will push malicous code via an update even if autoupdate is disabled.
If you have PolyMC installed uninstall it ASAP. The longer it is installed the more at risk you are.
If you have used PolyMC in the past or use it now, your Microsoft account you’ve used to sign-in to PolyMC could also be at risk, make sure you remove PolyMC’s access from your Microsoft account here: https://account.live.com/consent/Manage
For the time being, use other launchers, MultiMC, Vanilla, etc.. Anything that is trusted is better than the risk PolyMC poses currently. See the update below for information of what to use instead of PolyMC
UPDATE: The maintainers & contributors from PolyMC that were kicked out have created their own replacement for PolyMC, Prism Launcher.
If you’re looking for what to do now, check out Prism Launcher’s latest release on their website!