Apple kept mum about XcodeGhost malware attack against 128M users