Open source packages with millions of installs hacked to harvest AWS credentials | IT PRO