Hackers have compromised dozens of popular open source packages in an ongoing supply-chain attack — Trace