<p>Hosting software vendor tells customers to reset credentials and hunt for malicious packages</p>