New GitHub malware campaign is quietly poisoning developer projects