Software Supply-Chain Attacks

What it is

Software supply-chain attacks compromise something a product relies on before it reaches the final user. Targets include dependencies, vendor updates, build systems, and signing or distribution channels. Installing from a familiar source reduces ordinary download risk, but it cannot completely eliminate a compromise inside that trusted source.

How it works

An attacker adds malicious code to a package, takes over a maintainer account, or alters a build artifact. Downstream systems install the result through normal workflows. Signing can prove that an artifact came from a signing process, but a compromised signing process can still produce a signed malicious artifact.

How people get tricked

Trust is inherited from a supplier and treated as permanent. A package with a near-identical name may also deceive developers. Automated updates or builds can spread the affected component widely before anyone notices its behavior.

Example scenario

A compromised dependency update runs during application installation and reads build credentials available in the environment. The application code itself was not the initial point of compromise.

Warning signs

• Trusted advisories identify affected component versions or artifacts.
• Unexpected install scripts, network behavior, or publisher changes.
• Artifact provenance or reproducibility checks disagree with expected builds.

If it happens to you

Identify every use of the affected component, replace it with a verified safe version, and inspect actions it could perform. Rotate secrets exposed during build or runtime. Confirm artifact integrity and supplier guidance; downgrading a package does not undo stolen credentials.