With attackers increasingly compromising open source packages to spread malware, organizations need to be on their guard