Supply chain malware is malicious code that reaches a target through trusted software delivery paths, such as signed updates, third-party packages, dependency repositories, or build tooling. Because it enters through normal development and deployment channels, it can bypass perimeter controls and appear legitimate to developers, CI/CD systems, and endpoint tools.
This technique matters because one compromised package or dependency can seed many victims at once. Attackers use it to implant backdoors, steal secrets, or stage later payloads, while defenders must verify provenance, enforce artifact signing, pin dependencies, scan build inputs, and monitor unusual network behavior from software-install or update processes. In practice, supply chain malware often blends into routine maintenance, so looking only for known bad files is not enough; teams also need strong trust validation and anomaly detection around software distribution.