Researchers say Sapphire Sleet socially engineered maintainers before publishing malicious updates through trusted accounts