Malware in an Open-Source Project Could Have Infected Thousands. The Twist? It Was Certified by Delve