supply chain attack
in English: software supply chain attack
An attack in which the attacker does not break into you directly but hides malware in software, an update or a supplier that is believed to be trustworthy.
In plain terms
Imagine the burglar does not pick your door but breaks into the lock factory and makes a key for every lock produced. You buy and install the lock unsuspectingly, as it comes from a trusted brand. This is how a supply chain attack works in the software world.
Most of today's programs are not written from scratch. An average application consists of hundreds of ready-made building blocks written by others, so-called packages, which are updated regularly. If an attacker inserts malicious code into a single popular component or a manufacturer's update, it automatically reaches everyone who uses it.
This differs from typical attacks because trust is the weak point here. You do not need to click a malicious link or open a suspicious file: the malware arrives via the official, signed, familiar channel.
In the AI era, the risk has grown. Coding agents install packages, extensions and external tools on their own, often without human review. As a result, a compromised component can get into a system faster and with less chance of being noticed.
How it works
- An attacker selects a widely used link: an open-source package, a software manufacturer's update system, a developer tool, or an extension connectable to an AI agent.
- It gains control over it, for example by stealing the maintainer's password or posing as a helpful volunteer for months. Another method is to publish a fake with a name deceptively similar to that of a well-known package.
- It hides malicious code in the new version, which appears to be a legitimate update from the outside and often carries a valid digital signature.
- Users, companies' automated systems, and coding agents download and install the update, so the malware can reach as many as thousands of places at once.
- The hidden code then steals data, passwords, or access keys, opens a backdoor, or spreads to the next link in the chain. Infections are often detected only weeks or months later.
An everyday example
Your company's accounting software updates itself one morning as usual, and you click the 'Restart' button. If the manufacturer's system was hacked beforehand, the attackers' code was also uploaded to your machine with this update. Meanwhile, you did nothing irregular.
Who is affected
A common misconception
Limits and risks
- As an individual user, you have almost no means to detect a compromised official update. Defense is largely the responsibility of manufacturers and developers.
- Open source is not secure just because anyone can review it: many basic packages are maintained by one or two overworked volunteers, and the code is actually reviewed by few.
- AI models sometimes invent non-existent package names. Attackers can pre-register these names, causing the coding agent to install the malicious package.
- The component list (SBOM) and digital signature are useful, but they only show what the software consists of and who provided it, not whether it is free of malware.
Similar, but not the same
- phishing – Phishing tries to deceive you with a fake message, while a supply chain attack compromises the software supplier and reaches you without your involvement.
- software vulnerability – A vulnerability is an accidental program bug that someone later exploits, whereas in a supply chain attack, malicious code is deliberately smuggled into the software.
- prompt injection – Prompt injection diverts an AI model with a hidden text instruction, while a supply chain attack infects software components or updates.
Related concepts
cybersecurity, cyberattack, software security
dependency disruption, typosquatting attack, package hallucination, poisoned model
open source, software dependency, software bill of materials, coding agent, prompt injection, back door
A brief history
The core idea was popularized by Ken Thompson in his 1984 lecture, in which he showed that a backdoor can be hidden even in the tool used to build programs. The concept became widely known after the SolarWinds incident, uncovered at the end of 2020, in which malicious code reached about 18,000 customers through an update to network-management software. In 2024, a backdoor was found in the open-source tool XZ Utils, planted by a contributor who had spent years building trust. In autumn 2025, a self-propagating piece of malware (Shai-Hulud) infected several hundred packages in the npm registry.
Where things stand
At the end of 2026 this is one of the most frequently cited cybersecurity threats, as malicious packages are regularly found in open-source package registries. Attention is increasingly turning to packages, plugins and downloadable models installed by AI agents. Under the EU Cyber Resilience Act, manufacturers have been required since September 11, 2026 to report actively exploited vulnerabilities and serious security incidents; the other obligations, including the inventory of components, apply from December 11, 2027.
In the news
- Tampered Claude Code extension installed an SSH backdoor on about 5,000 machinesOct 30, 2026 · Agent Age
Also known as
supply chain attack · supply chain attack · supply chain attack · software supply chain attack · supply chain attack · software supply chain attack · supply chain attack · third-party attack
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.