I recently saw a "supply chain attack" on a Web3 company[0] and it turned out it was a contractor pushing malicious code.
I've worked on "code provenance" professionally before[1] which is, apparently, a subset of "supply chain security". Specifically, I worked to help make sure that the code a dev committed was signed by their laptop, up through the CI, through the vuln scanners, and then the artifacts were verified before being deployed.
It was a lot of work and it is it's own entire field (which is what the OP article is talking about).
But now I'm also working on supply chain security[2] because I'm building tech to scan for vulns in dependencies (like NPM) by blocking known malicious packages or just enforcing security policies based on known vulns in them.
How they are all bucketed under the same term, I don't know, and it hurts my soul. We need some better terms for this stuff.
Anybody have any ideas?
0: https://ambcrypto.com/exec-issues-fbi-warning-as-sushiswaps-...
1: https://medium.com/uber-security-privacy/code-provenance-app...