Fake reviews, news articles, and GitHub accounts are a potent mix for promoting malware.