At first, the team described what happened as an “unexplained incident.” That didn’t last long. MANTRA later said an attacker had attempted to exploit a vulnerability in an upstream dependency software the chain relies on but doesn’t directly control.