IBM and Red Hat's Project Lightwell is a joint initiative to secure open source software backed by a $5 billion investment.
Security researchers say 5,500 GitHub repositories have been affected by the attack.