New type of supply-chain attack hit Apple, Microsoft and 33 other companies