Researchers warn that North Korea’s Lazarus Group is injecting crypto-stealing malware into open-source projects.