“Supply chain attacks, where vulnerabilities are injected into widely used open-source packages, were the cause of recent breaches like the one at Mercure.”