An OAuth supply chain compromise saw 'non-sensitive' Vercel data compromised and some internal systems accessed