The newly emerged worm has spread across hundreds of open source software packages, stealing credentials and infecting other components without much direct attacker input.