A cybercrime campaign called GlassWorm is hiding malware in invisible characters and spreading it through software that millions of developers rely on