[ibic]

If an attacker is so smart and patient to pull of a sneaky supply chain attack like this, I'd say he/she/they must have been quite carefully choosing the moniker and hide/obfuscate other potentially identity revealing information (afaik, there is no reliable identity information found at the moment). So by choosing a very typical Chinese name (Jia Tan), I believe this is intentially misleading/smearing. I can't believe a smart ass (potenially a state actor) would be so stupid to use his/her/their actual nationality or other information.