I think the more reasonable deduction is that the vendor's website was compromised, and that's where the attacker was able to introduce new files.