What is a software supply chain attack?
A software supply chain attack compromises something you trust and install, rather than attacking you directly. Typical routes are a poisoned package in a public registry, a compromised vendor update, or stolen build infrastructure. It is effective because the malicious code arrives through a legitimate, signed, expected channel that your defences are configured to allow.
The asymmetry is what makes these attacks attractive: compromising one widely-used dependency can reach thousands of downstream organisations that each did nothing wrong.
Detection is genuinely hard, because the delivery mechanism is your own update process. Controls that help are dependency pinning, verifying provenance and signatures, generating an SBOM so you can answer "do we ship this component?", and limiting what build systems can reach.
The question worth being able to answer quickly is not "are we secure?" but "which of our products contain this package, and at what version?" Organisations that can answer that in minutes recover in hours instead of weeks.
Related coverage
Supply Chain Attacksdispatches →Compromised packages, typosquatting campaigns, malicious dependencies, and software supply chain incidents on npm, PyPI, Go, and Rust.
More on attacks