WTF is a supply chain attack?
Short version
A supply chain attack reaches you through something you already trust, like a package, extension or update.
The briefing
- OWASP's take
- Breakdowns or compromises in the process of building, distributing or updating software. They sit at A03 in its 2025 Top 10.
- Poisoned package
- Attackers add malicious behavior to a popular package.
- Typosquatting
- They register a lookalike name to catch a typo.
- Trusted vendor
- They compromise a vendor so the bad code arrives as an upgrade.
- Real example
- In September 2025 CISA warned of a self-replicating worm called Shai-Hulud that compromised over 500 npm packages.
- What it did
- It hunted for GitHub tokens and cloud API keys, sent them out, then used stolen developer access to publish more compromised packages.
- Editor extensions
- Same firing line. VS Code says an extension can do anything VS Code can, including reading and writing files, making network requests and running external processes.
- The nasty part
- All you did was update. The bad code lands on developer machines, which is where the tokens and cloud keys live.
In the Threat Brief this looks like:
example-package 4.1.7 on npm is malicious. Check your lock files.
The exact version is what you hunt for. All it took was an update.
Example only. The product, versions and names are made up.
What to do
- Check your lock files and installed extensions for the exact version the alert names.
- Pin to a known good release.
- If the bad one ever ran, rotate every credential that machine could reach.
- Then go looking for indicators of compromise.