supply chain attack
also: upstream attack, dependency injection attack, software supply chain compromise
A security attack that targets a software vendor or dependency rather than the end user directly, compromising the integrity of legitimate software before it reaches users. Attackers inject malicious code into widely-used libraries, tools, or update mechanisms to affect thousands of downstream systems at once.
A supply chain attack exploits the trust relationships in software development and distribution. Instead of attacking individual users or companies, attackers compromise a trusted component—such as a popular open-source library, a vendor's build system, or package repository—knowing that code will be automatically pulled in by countless dependent projects.
Common vectors include compromised npm packages, Python pip modules, or compromised updates to widely-used tools. For example, the SolarWinds Orion breach in 2020 injected malicious code into legitimate software updates, affecting government agencies and Fortune 500 companies. Another example: attackers gaining access to a maintainer's credentials and releasing a trojanized version of a popular library.
Supply chain attacks are particularly dangerous because they bypass traditional security perimeters—users trust the software they're installing. Detection is difficult since the malicious code resides in legitimate, signed packages. Mitigation strategies include dependency scanning, code review automation, signed commits, and using lock files to pin dependency versions.