What is Software Supply-Chain Attack?

A software supply-chain attack targets the tools and components that other software depends on—open-source packages, build pipelines, or update servers—instead of attacking each victim directly. When the trusted component is compromised, every project that installs or updates it can receive the malicious code.

Common techniques

• Compromised maintainer accounts: attackers steal credentials and publish a malicious version of a legitimate package.
• Typosquatting: publishing packages with names similar to popular ones, hoping developers mistype.
• Dependency confusion: tricking build tools into fetching a public package instead of an internal one with the same name.
• Malicious install scripts: code that runs automatically when a package is installed (for example, npm lifecycle scripts or Python .pth files).
• Build-system compromise: tampering with CI/CD so the published artifact differs from the reviewed source.

Why they are effective

Modern applications pull in hundreds of dependencies, many maintained by small volunteer teams. A single popular package can reach thousands of organizations within hours of a malicious release.

Defenses developers use

1. Lockfiles and pinned versions, so updates are deliberate.
2. Provenance and signatures (such as npm provenance or Sigstore) to verify where a package was built.
3. Least-privilege tokens and two-factor authentication for maintainers.
4. Monitoring advisories and rotating secrets quickly if a compromised version was installed.

This glossary entry is general information.