ITG NowHome › AI glossary › Supply chain attack
What is a supply chain attack?
A supply chain attack sneaks harmful code into software through a tool, package or update that many people trust.
- Category Safety & law
- Also called supply-chain attack
- Updated 20 Oct 2026
Supply chain attack, explained simply
Most software is built from many pieces made by others. A supply chain attack poisons one of those pieces.
When you install the piece, you also install the harm. It spreads because people trust the source.
To stay safe, install from official sources, check the name closely and keep your tools updated.
On ITG Now, our free tool guides point you to the official repo and package name so you avoid fakes.
Related terms
DependencyPackage managerTyposquattingMalwareVulnerabilityFake GitHub stars
Questions people ask about Supply chain attack
How can I avoid a supply chain attack?
Use official sources, check names carefully and review what a tool installs. Updating helps too.
Supply chain attack vs typosquatting: what is the difference?
Typosquatting uses a lookalike name to trick you. A supply chain attack can also hit a real, trusted package.
Are open-source tools more at risk?
Any software can be hit. Open code can be inspected by many people, which also helps find problems.