Email security firm Proofpoint claims to have identified a targeted attack that uses an open-source installer for Windows packages named Chocolatey.