Fake VS Code alerts on GitHub spread malware to developers