E-commerce sites hacked in supply-chain attack