Highly invasive backdoor snuck into open source packages targets developers