Home Music and Digital Media Ars Technica Open source package with 1 million monthly downloads stole user credentials