⛓️
Supply‑chain Attack
Threats
Attack on upstream dependencies, build pipelines, or vendors to compromise downstream users at scale.
Definition
Supply-chain attacks compromise components, dependencies, build infrastructure, or distribution channels. Defenses include secure builds, code signing, dependency control, SBOMs, and monitoring.
In plain English
Attack on upstream dependencies, build pipelines, or vendors to compromise downstream users at scale.
Why this matters
Why it matters: They expand blast radius and can silently impact privacy by exfiltrating data from trusted software.
Example
Example: Enforce signed releases, isolate build systems, review dependency changes, and validate update provenance.