3 million iOS and macOS apps were exposed to potent supply-chain attacks