News Password-stealing malware hidden in open-source software — what to do