Most supply chain attacks target supplier’s code