Threat profile
Software supply-chain compromise
Malicious code reaches you through something you trust: a library, an update, a build tool or a vendor.
How it works
Modern software is assembled from many open-source packages and services. An attacker who compromises a maintainer account, publishes a package with a name close to a popular one, or tampers with a build system can reach every project that depends on it, without ever touching the final target.
What to look for
- A dependency you did not add, or one whose maintainer or repository recently changed.
- A new version that adds network access or install scripts.
- A lockfile that changes without a matching reviewed change.
What reduces the risk
- Pin versions with a lockfile and review dependency changes like code changes.
- Keep the dependency list short and remove what you no longer use.
- Maintain a software bill of materials so you can answer "are we affected?" quickly.
- Use multi-factor authentication for package-registry and source-code accounts.
Related tool
Sources
Related threats
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).