Fake Arch Linux package hid a script that could run attacker-controlled code as root Bitdefender