TRUSTED VENDORPOISONED?

A security vendor's own code got weaponized.