A supply chain attack is a type of cyberattack that targets a trusted third-party vendor who offers services or software vital to the supply chain.

Software supply chain attacks inject malicious code into software packages or applications in order to infect as many victims as possible, while hardware supply chain attacks compromise physical components for the same purpose.

Historically, supply chain attacks have referred to attacks against trusted relationships, in which an unsecure supplier in a chain is attacked in order to gain access to their larger trading partners. 

However, software supply chain attacks are the greater concern today. Modern software is rarely built from scratch. It combines third-party APIs, open-source packages, proprietary code, and external services. This creates a trusted path for attackers: they compromise a vendor, dependency, build system, software update, or service provider, then use that access and trust to distribute malicious code downstream to customers. A vendor supply chain attack broadly targets a trusted third-party provider or business relationship, while a software supply chain attack specifically compromises code, packages, development tools, or updates that organizations install and run.

Today, the average software project has 203 dependencies. If a popular app includes one compromised dependency, every business that downloads from the vendor is compromised as well, so the number of victims can grow exponentially.

Furthermore, software is often reused, so a vulnerability in one application can live on beyond the original software’s lifecycle. Software that lacks a large user community is particularly vulnerable, because a large community is more likely to expose a vulnerability faster than a project with few followers.

Supply chain attack statistics

Below are some statistics from CrowdStrike's 2026 Threat Hunting Report:

• 87% of identified software registry threats involved malicious npm packages in the first half of 2026 alone
• 131 AI framework packages were poisoned by STARDUST CHOLLIMA
• 300+ software dependencies were compromised in a single day by ALTERED SPIDER

Attacks on the rise

Supply chain attacks are increasing because organizations have strengthened their own systems, prompting attackers to target trusted vendors, software dependencies, and service providers instead. The attack typically follows a trusted distribution path: criminals identify a vendor or dependency with access to many customers, compromise its code, build system, update process, or credentials, and hide malicious changes in a legitimate product or service. When customers install the compromised software or receive a trusted update, the malware propagates downstream. Attackers can then execute code, steal data, establish persistence, or use the initial access to reach additional systems. Because the activity appears to come from a legitimate vendor, it can bypass security controls and remain difficult to detect. 

Below are the types of supply chain attacks:

• Open source software attacks introduce code into builds that propagate downstream to those who use the build.
• CI/CD infrastructure attacks introduce malware into the development automation infrastructure, such as by cloning legitimate GitHub repositories.
• Upstream server attacks are the most common, in which a malicious actor infects a system that is “upstream” of users, such as through a malicious update, which then infects all the users “downstream” who download it. This is what happened with the SolarWinds supply chain attack.
• Midstream attacks target intermediary elements such as software development tools.
• Dependency confusion attacks exploit private internally created software dependencies by registering a dependency with the same name but with a higher version number on a public repository. The false dependency is then likely to be pulled into the software build instead of the correct dependency.
• Stolen SSL and code-signing certificate attacks compromise the private keys used to authenticate users of secure websites and cloud services. Stuxnet falls into this category.

Examples of supply chain attacks

The SolarWinds Orion attack is one of the most widely known supply chain attacks. Attackers inserted malicious code into the software build process, compromising a trusted update that reached about 18,000 customers, including major organizations and government agencies. The attack gave criminals unauthorized access to affected systems and sensitive data, creating risks such as operational disruption, financial loss, regulatory consequences, and reputational damage, even for organizations with advanced cybersecurity tools and services. 

Another sophisticated supply chain attack targeted the ASUS Live Utility, a software utility that is pre-installed on ASUS systems and automatically updates a computer’s BIOS, UEFI, drivers, applications and other components. Over 57,000 users are known to have downloaded and installed the compromised utility, although the real number is probably far greater. This was a targeted attack aimed at a group of users with specific MAC addresses.

A popular open source JavaScript tool was the target of an attack aimed at Linux and macOS operating systems. The attack used a technique called brandjacking, which tricks users into downloading malicious code. The targeted software, Browserify, is downloaded by more than 1.3 million users every week, so the ramifications of its compromise were potentially massive. In this case, the attack was identified and halted within a day of its launch. However, there are many other attacks of this type that are missed. In 2020, at least 26 open source projects were targeted in supply chain attacks.

Cybersecurity companies themselves are targets of supply chain attacks. For example, the popular free cleanup tool, CCleaner, was compromised with a backdoor that gave malicious actors access to the millions of computers on which the software was installed. Although CCleaner was a product of Avast, a security company, it was actually compromised before Avast bought the company that originally created it. The attackers installed their backdoors and then waited until the acquisition was completed before it began contaminating the downloads. Researchers believe this to be a targeted attack because while 2.27 million malicious downloads were completed, only 40 compromised systems were targeted with a second-stage attack.

How do you prevent and detect a supply chain attack?

Supply chain attacks are increasingly becoming a business-critical issue because they target trusted relationships with partners, suppliers, and software providers. They are difficult to detect because malicious updates or compromised dependencies can travel through legitimate channels, appear to come from a trusted vendor, and pass standard signature-based security checks. A software product that was validated in the past may later contain new vulnerabilities or malicious code, so previous approval does not guarantee its security today. Organizations must continuously monitor software behavior, dependencies, and vendor activity to identify threats that traditional security controls may miss. 

Along with rigorously assessing the vendors they use, organizations need to mitigate the supply chain risks that are making them vulnerable to attack. This requires employing effective prevention, detection and response technologies.

The following are some recommendations for how organizations can increase their supply chain security and avoid becoming a victim:

• Shrink exposure windows with granular controls and cooldown protection: Compromised packages are often most dangerous in the first 48 hours, before the broader community detects the threat. Cooldown protection can automatically hold newly published package versions for approval during this critical timeframe, drastically shrinking your window of exposure. Paired with granular policy controls, security teams can enforce precise, context-aware rules across specific environments and workloads, stopping supply chain risks without disrupting legitimate business operations.
• Use behavioral detection and continuous monitoring: Behavioral-based security can identify a supply chain attack even when software appears legitimate and has a valid signature. Deploy machine learning (ML) and endpoint detection tools to monitor unusual process behavior, unexpected child processes, new persistence mechanisms, unauthorized network connections, privilege escalation, and changes to files or configurations. Alert on software that suddenly contacts unfamiliar domains, accesses sensitive systems, or behaves differently after an update. Organizations should also maintain an inventory of software, dependencies, vendors, and versions; review update activity and access logs; scan packages for known vulnerabilities and malicious code; and investigate anomalous behavior immediately. These controls help detect compromised systems early, before attackers can move laterally or affect downstream environments. 
• Employ solutions that include behavioral-based attack detection: The sophisticated nature of supply chain attacks require organizations to employ the power of behavioral-based analysis such as indicators of attack (IOAs). Mitigating the risks incurred "when good programs go bad" requires technologies such as ML that can detect patterns in hundreds, thousands or even millions of attacks per day. This is a feat that can't be accomplished with human insight alone.
• Get ahead of future supply chain attacks with threat intelligence: Threat intelligence will tell you when new supply chain attacks emerge and provide you with all the information you need to understand the attack and proactively defend against it. CrowdStrike Falcon® Counter Adversary Operations is CrowdStrike's automated integrated threat analysis tool that combines malware analysis, malware search and threat intelligence to deliver context-rich information that enables predictive security.
• Enhance your readiness with proactive services: The CrowdStrike Services team includes supply chain analysis as part of its Cybersecurity Maturity Assessment and also conducts tabletop exercises with customers, where they simulate a supply chain attack. This gives customers an understanding of their current exposure and a roadmap for enhancing protection against, and readiness for, a supply chain attack.