thumbnail PHP Supply Chain Attack on Composer