Attackers stole a limited amount of internal credential material after malware hidden in poisoned packages reached two staff machines