The threat actor targeted a highly popular open source project with more than 100 million weekly downloads, creating a large “blast radius.”