I'm not sure it would cover open source software since it seems to be more concerned with data than the actual code. If that open source software is being used by a company controlled by a foreign adversary then that would probably apply but if it's open source software created by a foreign adversary but being used by a US company I don't think that would.
The actual wording of the bill seems pretty vague so I could be wrong and they might be able to apply it just to software but that would kind of to against the entire option B that they're currently giving ByteDance where they can keep Tik Tok running by selling it to an American company.