A Chinese-linked cyberespionage group has pulled off a classic software supply-chain ambush, compromising a popular ...