TeamPCP has breached GitHub and hundreds of firms via software supply chain attacks, using a self-spreading worm to steal credentials and data.