How do malicious software packages get identified and taken down?