A tainted version was pushed as an update to more than 800,000 active websites.