Backdoored developer tool that stole credentials escaped notice for 3 months