ConnectWise disabled five third-party extensions across about 400 partner environments after researchers linked a worm-like toolkit to one of them.