The open-source supply chain hack represents “meaningful industry-wide risk”, according to an industry expert.