I ran a fake GitHub installer bash script on macOS and entered my password — need help understanding if I’m still at risk