Researchers say hundreds of booby-trapped code packages on a major programming platform were part of a state-backed campaign to steal crypto and infiltrate tech firms.