Also known as: software supply chain attack · third-party compromise
A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.
The appeal for attackers is leverage: compromising one widely-used library, build system, or managed service provider can yield access to thousands of downstream organisations that individually would have been hard targets.
Supply chain attacks defeat perimeter thinking entirely, because the malicious code arrives via a signed update or a legitimate package installation. Defences focus instead on provenance and verification — SBOMs, reproducible builds, artifact signing, and dependency pinning.
An attacker who compromises a build server and injects a backdoor into the compiled binary distributes that backdoor to every customer who installs the legitimately-signed update.
SBOM
An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component and dependency contained in a piece of software, including version numbers and licence information.
Dependency Confusion
Dependency confusion is a supply chain attack in which an attacker publishes a malicious package to a public registry using the same name as an organisation's internal private package, causing build tooling to fetch the attacker's version instead.
Typosquatting
Typosquatting is the practice of registering package names or domains that closely resemble legitimate ones, relying on user typos or inattention to deliver malicious content to victims who intended to reach the real thing.
Code Signing
Code signing is the practice of cryptographically signing software artifacts so that recipients can verify who produced them and confirm the code has not been altered since signing.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.