The hosting provider's compromise allowed attackers to deliver malware through tainted software updates for six months.