Google, which disclosed the campaign, said it was one of the most significant supply-chain hacks in recent memory.