Publish Date
01/04/2026
Categories
Blogs Hot Topic
In the last few years, supply chain attacks have shifted from a niche cybersecurity concern to one of the most disruptive and far‑reaching threats facing modern organisations. The latest example, the compromise of the widely used JavaScript library axios, is a stark reminder that even trusted, everyday components can become vehicles for large‑scale compromise. With over 100 million weekly downloads, axios is embedded in countless applications. When attackers slipped a malicious dependency, plain‑crypto‑js, into the latest release, every developer or build system pulling the update risked unknowingly installing malware.
This incident is not isolated. It is part of a growing pattern of attacks exploiting the interconnected nature of modern software development. To understand why supply chain risk is now unavoidable, we need to look back at the major compromises of the last two years.
A Pattern of Escalation: The last two years of supply chain breaches
1. The Axios JavaScript Compromise (2026)
The axios attack demonstrated how attackers can weaponise dependency chains. The malicious package acted as a dropper, capable of executing shell commands, staging payloads, and erasing forensic evidence – classic behaviour designed to establish long‑term access inside developer environments and CI/CD pipelines.
2. The JavaScript Ecosystem Mega‑Attack (2025)
In 2025, attackers compromised 18 major npm packages, including chalk, debug, and ansi‑styles – collectively downloaded more than 2.6 billion times per week. The breach began with a phishing attack against a maintainer, allowing attackers to inject malware into foundational libraries used across the entire JavaScript ecosystem. The malicious code intercepted crypto transactions, altered API calls, and manipulated what applications believed they were signing – an unprecedented level of reach and sophistication .
This attack proved that supply chain compromises don’t just affect developers – they can cascade into every application, service, and business relying on those libraries.
3. Outlook Plugin Compromises (“AgreeToSteal”)
While not huge headline news at the time, the pattern of malicious Outlook add‑ins – such as the “AgreeToSteal” campaign, fits the same theme and narrative: attackers infiltrate trusted extensions or plugins to harvest credentials, intercept communications, or gain persistent access. These attacks exploit the trust users place in familiar tools.
4. Silk Typhoon and State‑Aligned Supply Chain Intrusions
State‑aligned groups such as Silk Typhoon have increasingly targeted software supply chains to gain strategic access. These operations often focus on identity systems, email platforms, and cloud infrastructure via remote management tools or holes in cloud applications – high‑value targets where a single compromise can yield access to thousands of organisations.
5. SolarWinds: The Blueprint for Modern Supply Chain Attacks
The SolarWinds compromise remains the defining example. Attackers infiltrated the build system of a widely deployed IT management platform, inserting a backdoor into legitimate updates. When customers installed the update, they unknowingly deployed malware into their own networks. This attack demonstrated the catastrophic potential of supply chain breaches and reshaped global cybersecurity policy. This attack actually affected Microsoft itself and caused a huge furore as it had to explain to customers and investors how the breach happened and how long for.
Why Supply Chain Attacks Are So Dangerous
Traditional cyberattacks target a single organisation. Supply chain attacks target everyone downstream.
A single compromised dependency can impact:
- Developers
- Build pipelines
- Cloud workloads
- End‑user applications
- Customers, Resellers and Partners
Attackers exploit the fact that businesses inherently trust their tools, libraries, and vendors. Once inside the supply chain, they bypass perimeter defences entirely and a single breach gives them potentially unlimited rewards in size and scope of customers within.
Mitigating Supply Chain Risk: What Organisations Must Do
Supply chain risk cannot be eliminated, but it can be significantly reduced. Here are the key principles every organisation should adopt:
1. Implement Zero Trust for Code and Dependencies
Assume no package, plugin, or update is inherently safe. Validate everything – especially third‑party components.
2. Enforce Strong Identity and Device Security
The npm mega‑attack began with a single successful phishing email. Protecting developer accounts with phishing‑resistant MFA and strict access controls is essential.
3. Monitor for Unexpected Dependency Changes
Tools that detect new or suspicious dependencies such as EDR, MDR and SOC that can detect changes with advanced hunting techniques to identify compromise like the malicious plain‑crypto‑js package – can limit attacks before they spread.
4. Harden CI/CD Pipelines
Build systems are prime targets. Protect them with isolated environments, have code built to proven standards and utilise code signing, strict secrets management, and airgaps.
5. Maintain a Software Inventory and enforce Governance
Knowing what’s in your environment is the first step to responding quickly when a dependency is compromised. Locking down the allowed software and solutions is the next step to further mitigate risk.
6. Vet Vendors and Third‑Party Integrations
From Outlook plugins to cloud services, every external component introduces risk. Vendor security posture must be part of procurement. Ask hard questions such as availability reports, penetration testing, MDR, SOC, SIEM and SOAR solutions, backup and recovery solutions. If they can’t answer, then question why.
Conclusion: Supply Chain Risk is now a Core Business Risk
The axios compromise, the npm mega‑attack, and the long shadow of SolarWinds all point to the same reality: supply chain attacks are now one of the most effective and scalable attack vectors in the world. Every organisation, regardless of size or sector, depends on software built on layers of third‑party components and in a solution service ecosphere. Understanding these risks, and building a strategy to mitigate them, is no longer optional.
Supply chain security is now business security. And the organisations that ask the right questions, and invest in visibility, verification, and resilience will be the ones best positioned to withstand the next wave of attacks.