A supply chain attack compromises a trusted supplier – a software vendor, library, update server or service provider – in order to reach that supplier’s customers.
How supply chain attacks work
Instead of attacking a well-protected target directly, the adversary goes after something the target already trusts. Typical scenarios:
- malicious code in a vendor’s build system that ends up in signed updates;
- poisoned open-source packages in npm, PyPI or NuGet, including typosquatted names and hijacked maintainer accounts;
- compromise of a managed service provider (MSP) or remote management tool that has access to many clients;
- tampered hardware or firmware.
Why supply chain attacks matter for security
One breach scales to thousands of victims, and the malicious code arrives through legitimate, digitally signed channels that security tools trust. In 2020 the SolarWinds Orion update carried the SUNBURST backdoor to about 18,000 customers, and the attackers, an APT group, then selected government agencies and tech firms for deeper intrusion. In 2017 NotPetya spread through the update of the Ukrainian accounting software M.E.Doc; in 2021 the REvil gang pushed ransomware through Kaseya VSA to about 1,500 businesses; in 2024 a backdoor was discovered in the XZ Utils compression library shortly before it reached major Linux distributions.
How to defend
- Inventory third-party software and dependencies (SBOM) and assess suppliers’ security.
- Pin and verify dependencies, watch for suspicious new package versions and maintainers.
- Limit the network access and privileges of vendor tools; monitor them like any other admin tool.
- Protect your own build pipeline: signed commits, isolated builders, reproducible builds (SLSA).
