A new supply chain hack points to China