The modern focus on the software supply chain grew from a short list of events between 2014 and 2024. This timeline covers Heartbleed and Shellshock in 2014, NotPetya in 2017, SolarWinds in 2020, Log4Shell and Kaseya in 2021, and the XZ Utils backdoor in 2024.
Timeline
This follows the Wikipedia article on the software supply chain, with details from the individual articles.
- 2014, Heartbleed and Shellshock. Both disclosed in 2014. They showed why teams need vulnerability management and software composition analysis, because a flaw in a shared component reached huge numbers of systems.
- 2016, left-pad. An unpublished package broke builds, a reminder that availability is a supply chain risk too.
- 2017, NotPetya. Listed in the article among supply chain events, in the context of the 2017 Ukraine ransomware attacks.
- 2018, event-stream. A malicious dependency, flatmap-stream, was added to event-stream version 3.3.6 and carried an encrypted payload that stole bitcoins from certain applications.
- 2020, SolarWinds. A malicious update was installed by more than 18,000 organisations.
- 2021, Log4Shell and Kaseya. A flaw in Log4j affected many companies' supply chains, and the Kaseya VSA ransomware attack hit through a management product.
- 2024, XZ Utils. A backdoor was caught by a security researcher shortly after release.
What each is usually used to teach
- Shared libraries make one bug into many.
- Package registries are part of your build.
- Build systems can be compromised, not just source.
- Transitive dependencies hide exposure.
- People are an attack surface: a maintainer can be pressured.
What the timeline hides
A list flatters hindsight. At the time, each of these looked like a one-off. Also, the list includes only widely reported events. Many smaller compromises never reach it.
The article also says that the Cyber Supply Chain Management and Transparency Act was proposed in the US in 2014 and failed, but led to the Internet of Things Cybersecurity Improvement Act of 2017. That is a reminder that law moves slowly compared with incidents.
How to use a timeline in your own planning
Pick the incidents and ask the same question of each: if this happened to a component we use, how long would it take us to find out, and what would we do next? Your answers show which capability you are missing.
Keeping your own timeline
Consider keeping an internal incident timeline of your own, with near misses included. A near miss might be a dependency that changed owner, a token found in a log, or a build that failed oddly. Review the list twice a year and look for patterns. You will probably see two or three recurring causes, which tell you where to invest. Public timelines teach the general lesson, but your own list tells you what actually happens in your environment, which is more convincing to your own team.
Quick check
Which 2024 event involved a backdoor in a compression library?
The XZ Utils backdoor.
How many organisations installed the malicious SolarWinds update?
More than 18,000, according to the source cited below.
Safeguard offers SBOM and dependency scanning, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
