Details are starting to emerge about a stunning supply chain attack that sent the open source software community reeling.