📋 What Is It?
Software Supply Chain Failures occur when an attacker compromises any of the people, code, tools, or infrastructure that software depends on before it reaches production, so malicious or vulnerable code is delivered through channels the victim already trusts. A team can write flawless code and still ship a backdoor, because the compromise lives in a dependency, build server, signing key, base image, or third-party script.
A03
OWASP Rank
1000s
Transitive Deps
Trusted
Delivery Channel
⚠️ Common Attack Vectors
- Typosquatting: malicious look-alike package names
- Dependency confusion: public shadows an internal name
- Malicious install hooks: npm postinstall, setup.py
- Hijacked maintainer account or package
- CI/CD pipeline compromise + leaked secrets
- Compromised CDN / script (Magecart skimming)
🔴 Attack Flow
1. Find a trusted upstream (dep, maintainer, CDN)
↓
2. Compromise it (typosquat, hijack, poison runner)
↓
3. Publish malicious version (validly named/signed)
↓
4. Victim pulls / auto-updates (install, pull, build)
↓
5. EXECUTE downstream: steal secrets, backdoor!
↓
2. Compromise it (typosquat, hijack, poison runner)
↓
3. Publish malicious version (validly named/signed)
↓
4. Victim pulls / auto-updates (install, pull, build)
↓
5. EXECUTE downstream: steal secrets, backdoor!
❌ Vulnerable Code
<!-- Whatever the CDN serves today runs with full DOM access.
A compromised CDN injects a skimmer silently. -->
<script src="https://cdn.thirdparty.example/analytics.js"></script>
<!-- "latest" URLs are mutable -- a swap is undetectable -->
<script src="https://cdn.thirdparty.example/lib/latest/lib.js"></script>
✅ Secure Code
<!-- Pin an immutable version + require a matching hash.
The browser refuses to run altered content. -->
<script src="https://cdn.thirdparty.example/analytics@3.2.1/analytics.js"
integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K"
crossorigin="anonymous"
referrerpolicy="no-referrer"></script>
# In package.json: pin exact versions, then:
# npm ci --ignore-scripts
✓ Prevention Checklist
- Generate & store an SBOM (CycloneDX/SPDX) per build
- Install from lockfiles with hash verification
- Never use floating version ranges in production
- Sign artifacts & publish provenance (SLSA / cosign)
- Reserve namespaces; resolve internal names privately
- Run SCA in CI; gate merges on critical findings
- Use ephemeral CI creds; pin actions by commit SHA
- Add SRI to third-party scripts; enforce strict CSP
- Pin container bases by digest; scan images
- Enforce publisher 2FA; review updates before adopting
🌍 Real-World & Pitfalls
You can't grep your way out: malicious payloads arrive validly named and validly signed through channels you already trust, so signature-based scanning alone will miss them.
Common pitfall: Floating ranges like
Common pitfall: Floating ranges like
^4.0.0 or * let an auto-update pull a freshly compromised release. Pin exact versions, install from lockfiles, and run install scripts only when you must.
🔍 Tools & Takeaway
Syft / CycloneDX
cosign / Sigstore
OSV-Scanner
Trivy
Grype
Dependabot
Key Takeaway: Most of your code is someone else's, so trust in every link of the chain must be verified, not assumed — through inventory (SBOM), immutable pinning, provenance, hardened CI/CD, and browser-tier SRI/CSP.