What is a software supply-chain attack?
An attack that tampers with software you already trust, such as an update, library or editor extension, so that installing it also installs the attacker's code.
In plain English
Instead of breaking into a target directly, attackers tamper with something the target already trusts and installs: a software update, a code library, an editor extension. When the victim installs the trusted thing, the attacker’s code comes along with it, usually without any warning sign.
An example
This week researchers reported a backdoored copy of the official Claude Code extension for VS Code on the Cursor Marketplace. Two versions quietly added an attacker’s SSH key to the developer’s machine and tried to turn on remote access. Cursor pulled the affected versions, but anyone who installed them had to assume their laptop was exposed.
Watch out
Developer tools are a prize target because they run with your permissions and sit next to source code and credentials. Pin versions, follow vendor security notices, and check which machines installed an affected release rather than assuming every update is safe.