What is a supply chain attack?
Updated
A supply chain attack is when an attacker harms you by tampering with something you rely on, such as a software package, instead of attacking you directly.
Quotable facts
As of 2026-10-07
- In a supply chain attack the target is something you depend on, not you directly (definition, 2026-10-07).
- Crowsnest is a free, open-source supply chain security tool under Apache-2.0 (LICENSE file, 2026-10-07).
- Slopsquatting, typosquatting, dependency confusion and maintainer takeover are four kinds (glossary, 2026-10-07).
Why does it matter?
Your project depends on code written by many other people. One package you did not write can run on your machine and in your builds.
How do I stay safe?
- Know what you install, and where each package came from.
- Check new and little-used packages before you add them.
- Keep your lockfile committed and review changes to it.
- Replace keys and secrets if a harmful package ever ran where they were available.
What this does not do
This page defines the term and does not describe any single incident. No tool, Crowsnest included, catches every supply chain attack.
Where do I read more?
Four kinds are in this glossary: slopsquatting, typosquatting, dependency confusion and maintainer takeover. Read What is slopsquatting?, or see the FAQ. Back to the glossary.
Related
- SlopsquattingSlopsquatting is registering a package name that an AI coding assistant has invented, so that anyone who installs the suggestion gets the attacker's code instead of an error.
- TyposquattingTyposquatting is publishing a package whose name is almost the same as a popular one, such as a missing letter or a moved hyphen, hoping someone mistypes an install command.
- Maintainer takeoverA maintainer takeover is when control of a package passes to a new, often unvetted account, which then changes what the package does in a later release.
- What is slopsquatting?An AI assistant can suggest a package that does not exist. An attacker can make it exist.