Software supply-chain attacks
Planting malicious code in software people already trust: open-source packages, browser extensions, updates or build systems.
New
4 attacks reported in the last 90 days (0 in the 90 before)
4 in 12 months
MITRE ATT&CK: T1195
Our deep dive on this technique is being prepared from our reporting. The attacks we have covered are below.
Attacks we reported
- Unit 42 Details Top Initial Access Vectors for September 2026
- AWS GuardDuty Adds Five Indicators for Attack Sequences
- Unit 42 Details Web3 Evolution in Cloud Supply Chain Attacks
- Microsoft details NeedyMantis malware in targeted intrusions
All hacking techniques · We explain how attacks work so you can defend against them; we never publish instructions for carrying one out.