Digital Lexicon Hub

A cyberattack that compromises a trusted supplier, software component, update channel or service provider to reach that supplier's customers.

One compromised plugin, library or IT provider can expose every customer at once, so vendor selection, software inventories and update controls become security decisions for marketing and web teams, not only IT.

An agency managing 40 WordPress sites keeps an inventory of every plugin and version, subscribes to vulnerability feeds, and removes a form plugin from all sites within hours after its maintainer account is reported compromised.

Customers cannot audit most vendors' build systems, so controls reduce but do not remove exposure. SBOMs and questionnaires show what is declared, not what was tampered with, and blocking updates creates its own vulnerability risk.

Attackers insert malicious code into source repositories, build pipelines, package registries or signed updates, or abuse the trusted access of managed service providers. ENISA reported that supply chain attacks grew in number and sophistication in 2020 and 2021. Defenses draw on NIST cybersecurity supply chain risk management (C-SCRM) and the Secure Software Development Framework, software bills of materials, code signing and Vulnerability Management, governed through a Third-Party Risk program.