We pwned X, Vercel, Cursor, and Discord through a supply-chain attack