Lying in Wait: Uncovering Hidden Threats in Open Source Software