Supply-chain malware is malicious code inserted into software distribution channels so it reaches many downstream users through normal trust paths. Instead of attacking each victim directly, the attacker compromises a package, update feed, build system, or maintainer account and lets legitimate tooling deliver the payload. In ecosystems like npm, this can be especially dangerous because installing a package may also run lifecycle scripts, turning a download into code execution.
It matters because one poisoned dependency can spread into developer laptops, CI runners, and production builds before defenders notice. Real attacks often hide in lookalike packages, hijacked accounts, or backdoored updates that appear routine to scanners and reviewers. Defenses include dependency pinning, reviewing unexpected version changes, limiting or disabling install-time scripts where possible, using strong publishing controls, and scanning packages for malicious behavior. No single control is enough: supply-chain security works best when identity, integrity, and local execution safeguards are combined.