An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.