The software supply chain is the attack surface
Compromising one widely used package reaches further than compromising one company. Defences are consolidating around provenance.
Modern applications assemble hundreds of third-party packages, most of which are transitive dependencies no engineer on the team has ever read. That structure is enormously productive and creates a single, well-understood path into thousands of organisations at once.
Recurring attack patterns
- Maintainer account takeover, typically through a reused credential or a stale token.
- Typosquatting and name confusion, which rely on a single mistyped install command.
- Malicious build scripts that execute on install rather than at runtime, evading source review.
What actually reduces exposure
Lockfiles with integrity hashes. Build provenance attestations that tie a published artefact to a specific source commit and builder. Disabling install-time scripts by default. Reviewing dependency additions with the same seriousness as a code change, because that is what they are.
None of these are novel. They are, however, unevenly adopted, and the gap between the teams that apply them and the teams that do not is where most successful incidents live.
Sources
About the author
Security & Web Correspondent
Priya Raman reports on authentication, software supply chains and the changing shape of search and the open web. Her work focuses on how security decisions affect ordinary users.
