The attack could have been part of an attempt to compromise the software supply chain, the researchers said.