A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.