Supply Chain Attack

Definitions

1. An attack that compromises a target indirectly by subverting something the target trusts and installs, such as a software dependency, build system, update channel, or hardware component. The economics are brutally favourable to attackers: one compromised upstream package can reach thousands of downstream victims who never interacted with the attacker at all. The 2020 SolarWinds intrusion inserted a backdoor into a signed update reaching roughly eighteen thousand organisations; the 2021 Codecov breach altered a CI script to exfiltrate environment secrets; typosquatted npm and PyPI packages exploit a single character of inattention. Defences include pinning dependencies by cryptographic hash, verifying signatures, generating a software bill of materials, and reproducible builds that let independent parties confirm a binary matches its claimed source.

   In plain English: Instead of attacking a company directly, hackers compromise a tool or supplier that the company trusts, so the malware sneaks in through the front door.

   Example: "SolarWinds proved that if you compromise the supply chain, every customer becomes your victim."

Etymology

2017

NotPetya spreads via compromised Ukrainian accounting software update

2020

SolarWinds Orion compromise affects 18,000+ organizations

2024

XZ Utils backdoor discovered just before it ships in major Linux distros

Related Terms

• Hash
• Dependency Hell
• Package Manager
• npm

Collections Including This Term

• Security Jargon Decoded