The Shift in Attack Vectors
Think of building software like cooking in a restaurant. You write the recipe (your custom code), but most of the ingredients come from suppliers — flour, eggs, spices. If one supplier secretly adulterates their product, every dish you serve is compromised, even though your kitchen is spotless. Software supply chain attacks work exactly this way: attackers don't break into your house; they poison the ingredients you trust.
Supply Chain Security is the discipline of verifying the integrity and trustworthiness of every external component your software depends on — libraries, build tools, container base images, CI/CD plugins, and more. Modern applications are typically 80–95% third-party code. Your custom logic is a thin layer on top of an enormous stack of dependencies you did not write and may never have read.
Key Incidents That Changed the Industry:
- SolarWinds (2020): Attackers compromised SolarWinds' own build pipeline and injected a backdoor into the
Orionsoftware update. Roughly 18,000 organizations — including US government agencies — installed the malicious update because it was signed by SolarWinds' legitimate certificate. The attack was undetected for months. - Log4Shell / Log4j (2021): A remote code execution vulnerability (CVE-2021-44228) in
log4j, a Java logging library used by virtually every Java application on the planet, allowed attackers to execute arbitrary code by sending a single crafted string. The blast radius was so large that CISA issued an emergency directive. - event-stream (2018): A hacker offered to "help maintain" a popular npm package, was granted ownership, and then added a dependency containing code that specifically targeted Bitcoin wallets belonging to users of a specific application. The malicious code was hidden inside a transitive dependency — a dependency of a dependency — making it nearly invisible.
The common thread: none of these attacks required breaking your perimeter. They exploited the implicit trust developers place in the software supply chain.
Interviewers frequently ask: "What is a supply chain attack and how is it different from a traditional intrusion?" The key distinction is trust exploitation: a supply chain attack abuses a trusted channel (a signed package, an official update) rather than forcing entry through a defended boundary. A strong answer names a real incident (SolarWinds or Log4j), explains the trust relationship that was abused, and describes one concrete mitigation (hash pinning, SCA scanning, or SLSA provenance).