Attack

Supply-chain attack

Compromising a vendor, library or update so the attack reaches all of its customers at once.

Instead of attacking targets one by one, attackers poison something they all trust: an open-source package, a build system, a software update or a managed service provider. Victims install the compromise themselves through normal channels.