GitHub targeted in supply chain attack