Supply Chain Campaign Targeting Composer and GitHub Repositories