A large-scale supply chain attack dubbed FakeGit uses thousands of deceptive GitHub repositories to distribute SmartLoader malware.