Opening Pandora's Box – Supply Chain Insider Threats in Open Source Projects