You Don't Write Most of Your Code
Modern software development is like building with Lego blocks. You write a little bit of custom code — the glue — but the vast majority of your application consists of open-source libraries, frameworks, and base container images pulled from the internet.
Think about a typical Node.js application. You write 500 lines of code, but your node_modules folder might contain 50,000 lines of code written by hundreds of strangers. A Python data pipeline might pull in NumPy, Pandas, and dozens of transitive dependencies you never explicitly chose. A Docker image built on ubuntu:latest inherits every package the Ubuntu maintainers decided to include.
The Attack Vector
A Supply Chain Attack happens when a bad actor doesn't attack your servers directly. Instead, they compromise one of those small libraries you depend on — and poison the well.
When your automated build pipeline runs npm install or pulls a base image, it unknowingly pulls in the malware. You then build it, test it (the malware may be dormant during tests), sign off on it, and deploy it straight into production. The 2020 SolarWinds attack is the canonical example: attackers injected malicious code into a build process, and the resulting software was signed and distributed to 18,000 organizations. The 2021 ua-parser-js npm package hijack is another: a maintainer's account was compromised, and a malicious version was published to the npm registry and downloaded millions of times before detection.
The Three Questions That Define Supply Chain Security
Securing the supply chain means answering three critical questions about every piece of software you use:
- What is inside it? (Ingredients — answered by SBOMs)
- Has it been tampered with since it was built? (Integrity — answered by signing and verification)
- Where and how was it originally built? (Provenance — answered by SLSA attestations)
The rest of this lesson walks through the tools and frameworks that answer each question.