PHP Packagist supply chain poisoned by hacker “looking for a job”