Malicious Go package removed from GitHub, but credential threat persists | Heykuki News