A software supply chain attack happens when someone tampers with software you trust before it reaches you, so you install the problem yourself. The events below, from 2018 to 2025, each have a public primary source. The pattern is consistent: attackers go after the maintainer, the build, or the update channel, not the front door.
What is a supply chain attack, in one minute?
Your company builds on code written by others: libraries, build tools, update servers. If an attacker changes any of those, your normal install or update delivers it. You did nothing wrong in the usual sense, which is why these attacks are hard to catch.
The timeline
November 2018, event-stream (npm). npm's own write-up says a new maintainer added a malicious dependency, flatmap-stream, to the popular event-stream package on 9 September 2018. The attacker had posed as a maintainer to take over the package. The payload targeted one wallet application's build. npm removed it after being notified on 26 November.
December 2020, SolarWinds Orion. CISA issued Emergency Directive 21-01, saying Orion versions 2019.4 through 2020.2.1 HF1 were being exploited and ordering federal agencies to disconnect them. The software update itself carried the compromise.
April 2021, Codecov. Codecov said it learned on 1 April 2021 that someone had modified its Bash Uploader script without permission. The change sent environment variables from customers' CI runs to an outside server. Environment variables often hold credentials.
October 2021, ua-parser-js (npm). CISA warned that versions 0.7.29, 0.8.0 and 1.0.0 of this widely used package contained malicious code, and pointed users to the patched versions 0.7.30, 0.8.1 and 1.0.1.
December 2021, Log4Shell. This one is a vulnerability, not a tampering attack, but it taught the same lesson. CVE-2021-44228 affected Apache Log4j versions 2.0-beta9 to 2.14.1, a logging library buried inside countless products. CISA's guidance asked organizations to find every Log4j instance across all of their assets.
March 2023, 3CXDesktopApp. CISA reported that this voice and video conferencing app had been trojanized, with the vendor and several security firms publishing analysis.
March 2024, XZ Utils. Malicious code was found in XZ Utils versions 5.6.0 and 5.6.1 (CVE-2024-3094). CISA advised downgrading to an uncompromised version such as 5.4.6.
March 2025, tj-actions/changed-files. A popular GitHub Action was compromised (CVE-2025-30066), allowing disclosure of secrets such as access keys and tokens.
September 2025, Shai-Hulud (npm). CISA described a self-replicating worm that compromised over 500 packages, harvested developer credentials and used them to publish more compromised versions.
We have not listed 2026 events because we have not confirmed them against primary sources for this page.
What do they have in common?
Three things repeat. Trust in a maintainer or vendor was the entry point. Secrets in build environments were a frequent target. And in most cases, the first question organizations asked was "are we affected?", which needs an inventory they did not have.
What to do
- Keep a current inventory (SBOM) of what you ship and run, including transitive dependencies.
- Commit lockfiles and review changes to them as you would review code.
- Pin third party build steps to a specific commit rather than a moving tag.
- Keep long lived secrets out of CI where possible, and rotate them fast when an advisory lands.
- Require phishing resistant multi factor authentication on registry and source accounts.
- Practice the "are we affected?" question once a quarter with a real package name.
Quick check
Is a vulnerability like Log4Shell a supply chain attack?
Not in the strict sense, because nobody tampered with the library. It is a supply chain exposure, because you inherited the flaw through a dependency you did not write.
Which single control helps most?
A reliable inventory. Without one, every other response starts with guesswork.
Sources
- npm, Details about the event-stream incident
- CISA, ED 21-01: Mitigate SolarWinds Orion Code Compromise
- Codecov security update
- CISA, ua-parser-js malware
- CISA, Apache Log4j vulnerability guidance
- CISA, 3CXDesktopApp supply chain attack
- CISA, XZ Utils CVE-2024-3094
- CISA, tj-actions/changed-files
- CISA, npm ecosystem compromise
Last reviewed: 18 October 2026.
