It's a supply-chain attack against a limited users of NoxPlayer, which allows people to play Android games on PCs and Macs.