Supply chain
The people, systems, source, dependencies, build processes, and delivery paths involved in producing and distributing software.
- Defined in
- NIST glossary: supply chain
Covered in
Protect the path from pull request to release
Separate untrusted contribution checks from privileged release work and verify the identity of the artifact that is actually deployed.
Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)
How a trojanized trading application on one employee's personal computer led to 3CX's build servers and to signed, malicious 3CX DesktopApp releases in 2023: the first cascading software supply-chain compromise Mandiant had seen, how EDR caught it, and the controls that would have stopped it.
Treat model releases as executable supply-chain inputs
Verify provenance, constrain loading and preserve the relationship between model weights, configuration and runtime dependencies.
Adopt the OpenSSF S2C2F as a consumer: the eight practices, the four maturity levels and a staged plan with evidence
Assess how your organization takes in open source against the Secure Supply Chain Consumption Framework's 25 requirements, then reach each maturity level in turn with evidence an assessor can check.
Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)
How a pull-request-title injection in a GitHub Actions workflow on an outdated branch gave an attacker the Nx npm token in August 2025, how the malicious versions tried to turn developers' own AI command-line tools into file-search agents, and the workflow, publishing and agent controls that stop the same chain.
Harden GitHub Actions against workflow and supply-chain attacks
Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
All 33 pages that cover Supply chain in the library
Practice: Actions injection lab: Flag GitHub Actions expression injection · Local project: Build and verify a signed software release · Local project: Repair a security pipeline for GitHub Actions and GitLab CI