<p>Researchers say Sapphire Sleet socially engineered maintainers before publishing malicious updates through trusted accounts</p>