A software supply-chain attack compromises a dependency, provider, or delivery process so downstream applications receive harmful or vulnerable code. Because direct and indirect dependencies become part of the final executable, one trusted library can expand an application's attack surface. section 1.2
Event-Stream and Copay
After the Event-Stream maintainer transferred project control, a new developer added a backdoor. The altered package affected Copay Bitcoin wallet versions 5.0.2 to 5.1, showing how a compromised maintainer can reach downstream users. section 1.2
Reduce supply-chain exposure by:
- Validate direct and indirect dependencies, including code that the application does not explicitly use. section 1.2
- Run vulnerability scanners on every commit against source code, build files, and artifacts; fail builds that introduce vulnerable libraries. section 1.2
- Rescan after vulnerability databases change and combine automated upgrades with testing and delivery pipelines. section 1.2
