Software Supply-Chain Attack

A software supply-chain attack is a cyberattack that compromises software through the components, tools or suppliers used to create and deliver it. Instead of attacking the final user directly, the attacker exploits a trusted dependency or delivery channel, potentially causing users to install or run compromised software.

How the attack works

Software often incorporates third-party components and passes through development, testing and distribution systems. Attackers can compromise one of these upstream links so that malicious code reaches downstream users through an apparently legitimate product.

• A compromised software dependency, such as a third-party library, can introduce malicious code into applications that use it.
• An attacker can compromise a build system, which converts source code into distributable software, to alter the resulting product.
• A compromised update mechanism can distribute a malicious version to users who trust the supplier.
• Because many organisations may use the same supplier or component, a single upstream compromise can affect multiple downstream users.

Risks and safeguards

The central risk is misplaced trust: software obtained through a legitimate supplier is not automatically safe. Compromised software can enable data theft, unauthorised access or disruption.

• Organisations should assess suppliers and protect development systems through access controls and secure development practices.
• A software bill of materials, an inventory of software components, helps identify dependencies and assess exposure when a component is compromised.
• Integrity checks and digital signatures help verify that software has not been altered after signing, but do not guarantee that it was safe before signing.
• Monitoring, vulnerability management and incident-response planning help organisations detect compromise and limit its effects.