Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.
That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.