Cyber security · Interactive model

The Poisoned Package

You didn't write most of your code — you installed it. Your app pulls in packages, which pull in more packages, several levels deep. An attacker doesn't need to breach you; they just poison one tiny library buried down the tree and let it ride upstream into everyone who depends on it. This is how Log4j and SolarWinds happened. Poison a package, then switch on the controls that break the chain.