Supply-chain trust is confidence in where a third-party component came from, how it is updated, and who controls it. The component may be a software library, a model, a plugin, or a hosted service. Security teams care about this trust boundary because a dependency can be harmless today and dangerous after a compromised update, a hijacked account, or an unauthorized change in the distribution path.
In attacks, weak supply-chain trust lets malicious code enter through seemingly legitimate channels, such as poisoned packages, tampered installers, or altered service outputs. In defenses, teams reduce that risk by pinning versions, verifying signatures and hashes, reviewing maintainer access, limiting auto-updates, and isolating high-risk components from sensitive credentials and production systems. In short, supply-chain trust is not blind confidence in a vendor; it is the evidence and controls that make a third-party component safe enough to use.