The State of Open Source Supply Chain Attacks StepSecurity