Supply-chain attack hits via Drift, leaking customer info