The scary part is how easily malicious repos can blend in with legitimate open-source projects