Supply Chain Attack
Definition
Attack that compromises a software supply-chain component (dependency, build pipeline, vendor) to infect all of its consumers with a single intrusion.
Canonical cases: SolarWinds (build server compromised → 18k customers injected, including US govs), Kaseya (RMM software → ransomware in thousands of SMBs), MOVEit (file-transfer vulnerability → Cl0p exfiltrates from hundreds of customers), event-stream / Ledger BTC (npm packages compromised by maintainers or takeover).
Typical vectors: dependency confusion (publish a package with a private name in a public registry), typosquatting (request vs reqests), maintainer takeover (accounts with leaked or reused creds), build pipeline injection (compromised GitHub Action, open CI runner), repo jacking (GitHub user renamed/deleted, attacker claims the handle).
Defence: SBOM (Software Bill of Materials), version pinning + integrity hashes, automated dependency review, runner hardening (no secrets in public jobs), build/deploy separation, artefact signing (Sigstore).