GitHub hackers' hidden malware