A software supply-chain attack targets the trusted path used to build, sign, package, or distribute software instead of attacking an endpoint directly. The goal is to insert malicious code into something users and systems already trust, such as an update server, build pipeline, package repository, or installer.
This matters because trust can bypass normal defenses. Security tools may allow signed updates, and administrators may treat vendor traffic as safe. Attackers use that trust to spread malware, steal credentials, or compromise many systems at once. Defenders reduce risk with code signing, build isolation, strong access control, integrity checks, and careful monitoring of update behavior. Any unexpected change in a vendor package, build artifact, or update flow should be treated as suspicious until verified.