Supply chain attack
A supply chain attack compromises or manipulates a product, dependency, supplier, or delivery process to reach organizations that rely on it.
A trusted dependency carries the change
The attacker may alter a software package, compromise a publisher account, interfere with an update channel, or manipulate hardware before it reaches a customer. MITRE ATT&CK covers development tools, source repositories, dependencies, software distribution, and hardware delivery.
The downstream organization can then receive something malicious through a route it normally uses. The original product or supplier does not have to be fraudulent for that route to be abused.
NIST SP 800-161 addresses the wider task of managing cybersecurity risks across supply chains. That includes understanding dependencies and supplier practices, not just checking the final download.
A vendor name in a scam is not enough
Someone pretending to be a supplier and requesting new bank details is vendor impersonation. That deception does not, by itself, establish compromise of the supplier’s software or delivery process. State which relationship or component was actually abused.
Likewise, a vulnerable third-party component is a risk, but its existence does not prove that an attacker tampered with the supply chain. Investigation needs to establish what changed, who could introduce the change, and which customers or versions received it.
The browser-extension article follows publishing authority through to a changed extension and its installed version. The maintainer-handoff article examines who can take over a project’s authority. These are useful places to ask how a trusted contribution or update becomes approved code.
An approved supplier can still ship a compromised release. Track which versions you run and who can stop an update or coordinate a replacement if a supplier reports a compromise.