Are GitHub creds any harder for malware to steal than NPM creds? I don't see how that helps at all.