A03: Software Supply Chain Failures · 2025
Failures in dependencies, repositories, tools, build and distribution processes allow compromised components or artifacts to enter the system.
Summary
Failures in dependencies, repositories, tools, build and distribution processes allow compromised components or artifacts to enter the system.
How the attack works
An attacker compromises a dependency that the build process incorporates and distributes, introducing malicious code into the application.
Example
Vulnerable · Pseudocode# Unreviewed dependency update
npm install sample-tools@latest
npm run buildFix: Lock and review transitive dependencies; verify provenance before the build.
Prevention
- Maintain SBOMs, provenance and pinned component versions.
- Verify signatures and hashes and protect repositories and pipelines.
- Assess suppliers, update dependencies and reduce the supply chain attack surface.
Lineage
- 2013 · A9: Using Components with Known Vulnerabilities Continues in 2017
- 2017 · A9: Using Components with Known Vulnerabilities Renamed and moves up in 2021
- 2021 · A06: Vulnerable and Outdated Components Renamed and moves up from A9:2017
- 2025 · A03: Software Supply Chain Failures New and expanded from vulnerable components
- 2013:A9 → 2017:A9: The components category retains rank 9.
- 2017:A9 → 2021:A06: The category changes to Vulnerable and Outdated Components.
- 2021:A06 → 2025:A03: Vulnerable Components expands into Software Supply Chain Failures.