Supply Chain Attacks: Lessons and Defenses from SolarWinds to XZ Utils

The Supply Chain Attack Landscape

Supply chain attacks compromise trusted software to reach downstream targets. Instead of attacking organizations directly, adversaries poison the tools, libraries, and services those organizations depend on.

Notable Attacks

SolarWinds (2020)

• Compromised build system injected backdoor into Orion updates
• 18,000 organizations installed trojanized update
• APT29 (Russia) attributed
• Months of undetected access to government and enterprise networks

XZ Utils (2024)

• Social engineering campaign over 2+ years
• Attacker gained maintainer trust, then injected backdoor
• Targeted SSH authentication bypass
• Discovered accidentally through performance testing

3CX (2023)

• North Korean attackers compromised desktop VoIP application
• Cascading supply chain attack (attacked via another compromised library)
• Affected hundreds of thousands of installations
• Demonstrates supply chain attacks targeting supply chains

Attack Categories

1. Build System Compromise

Inject malicious code during the software build process. The source code appears clean, but the built artifacts contain backdoors.

2. Dependency Confusion

Upload malicious packages with internal package names to public registries:

# Internal package: @company/auth-utils
# Attacker publishes: auth-utils (no scope) to npm
# Build systems may prefer the public version

3. Typosquatting

Create malicious packages with names similar to popular ones:

lodash vs. l0dash, Iodash, lodash-utils

4. Maintainer Compromise

Compromise the accounts of legitimate package maintainers through credential theft, MFA bypass, or social engineering.

Defense Strategies

Software Bill of Materials (SBOM)

Maintain a complete inventory of all dependencies:

# Generate SBOM
syft scan dir:. -o spdx-json > sbom.json

Dependency Pinning and Verification

// package-lock.json with integrity hashes
"lodash": {
    "version": "4.17.21",
    "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3..."
}

Build Reproducibility

Ensure builds produce identical outputs from the same inputs, making tampering detectable.

Vendor Security Assessment

Evaluate the security practices of your software suppliers before and during the relationship.

Where SuperClue Fits

SuperClue does not scan dependency manifests or package registries. Its DAST scanner fingerprints the JavaScript library versions your web pages load and flags versions with known vulnerabilities.