More than 100k websites targeted in web supply chain attack