Supply chain attacks are increasing in volume, but open source vulnerabilities continue relatively unnoticed.