Supply Chain Attack

A supply chain attack compromises something a project depends on rather than the project itself, so the malicious code arrives through a trusted update. In crypto this usually means a poisoned software library, a hijacked package registry account, or a tampered front-end build, after which every user of an otherwise honest application signs transactions crafted by the attacker. The December 2023 compromise of Ledger's Connect Kit library is a documented example, injecting a drainer into websites that loaded it from a public package registry. Defences are layered: pin and verify dependency versions, use a hardware wallet that shows the real transaction contents, and treat any interface that suddenly asks for an unusual approval as suspect.