Lobsters: Catching malicious contributions in open source repos