At this point, one should assume that "attack the supplier" is a known, standard strategy for any person or organization that supplies software or expertise to a larger or target organizations.