Hulud, which has already compromised several open source projects and, in turn, developers and companies that use them.