What Is Supply Chain Attack?
A software supply chain attack compromises an application by targeting something it trusts, such as an open source dependency, a build system, a CI pipeline or a vendor update, instead of attacking the application directly. One compromised component can reach every organization that uses it.
Also known as:
Common Types of Supply Chain Attacks
- Malicious package versions. An attacker takes over a maintainer account or project and publishes a version containing malicious code.
- Typosquatting. A malicious package is published under a name similar to a popular one, hoping developers install it by mistake.
- Dependency confusion. A public package uses the same name as a company's internal package so build tools pull the public one.
- Build and CI compromise. Attackers tamper with the pipeline that builds or signs software, so the shipped artifact differs from the source.
- Vendor update compromise. A trusted vendor's update channel is used to distribute malware to customers.
Notable Examples
The 2020 SolarWinds incident distributed a compromised update to thousands of customers. In 2024, a backdoor was discovered in the xz Utils compression library (CVE-2024-3094) after a long campaign to gain maintainer trust. Both show how attackers target the trust between projects rather than any single application.
Why Supply Chain Attacks Are Hard to Catch
Malicious versions are often published before any CVE exists, so scanners that only match known vulnerabilities have nothing to flag. Modern applications also pull in hundreds of transitive dependencies that no one reviews directly, and abandoned packages can be taken over quietly.
How to Reduce Supply Chain Risk
- Pin and review dependencies. Use lockfiles and review new or changed packages before they reach production.
- Use a cooldown window. Avoid adopting brand-new releases immediately, since many malicious versions are caught within days.
- Harden the build. Protect CI credentials, verify artifacts and follow a framework such as SLSA.
- Keep an inventory. Maintain SBOMs so you can answer “are we affected?” quickly.
Nullify brings supply chain risks into the same prioritized backlog as other findings and can run upgrade campaigns across repositories. See how Nullify manages supply chain risk.
Key Takeaways
- Supply chain attacks target trusted dependencies, build systems and vendors.
- Malicious versions often appear before any CVE exists.
- Transitive and abandoned dependencies widen the attack surface.
- Pin dependencies, use cooldowns, harden CI and keep an SBOM.
Read More About Supply Chain Attack
Program Management
See Nullify in Action
Nullify tracks supply chain risk in one backlog and drives the upgrades to completion.