10,000 cloned GitHub repos slip trojans past VirusTotal link checks

Search GitHub for a coding tool, pick a project that looks completely real, download its zip file, and you quietly get a trojan instead.