Hidden backdoor in Go package remained undetected for years