Comment by _fat_santa

Hmm they said that the malware came from a JS file called 'popper.js' and looking at their site it looks like they are using Bootstrap. Based on this sounds like a supply chain attack.