Strongest as the weakest link

News reports have recently highlighted a new and growing concern: Supply Chain Attacks. These are difficult to defend against as they come from inside the infrastructure chain. The components such as libraries, plugins, or even software itself can be compromised providing new attack surface. This is not isolated to any platform or software so it is important to explore risks unique to your environment


Popular software for Desktop

PCMag reported on a compromise of the Notepad++ website directing downloads to a malicious download. While up to date security software might catch the malicious software, it only takes one time for it to fail. This is part of what makes supply chain attacks hard to mitigate. They can come from any point in your chain. Fortunately, there are ways to mitigate it such as using winget. You can run the following to install Notepad++ directly:

winget install Notepad++.Notepad++

By downloading directly via package managers or the Microsoft Store, you can avoid sudden website vulnerabilities. This also leads us to more ways to secure depending on your needs and environemnt.


Minimum release date for local or Cloud development

Many popular package managers have minimum release age settings that can be configured to ensure packages have time to be discovered as compromised before infecting your system and compromising your data. These default to 7 days, but adjust as needed for the packaging utilities and requirements of your environment. You can comment these out to apply needed security upgrades for example:

~/.config/uv/uv.toml
exclude-newer = "7 days"

~/.npmrc
min-release-age=7 # days
ignore-scripts=true

~/pnpm/rc
minimum-release-age=10080 # minutes

~/.bunfig.toml
[install]
minimumReleaseAge = 604800 # seconds


WordPress plugins too?

Even some WordPress has been hit by a supply chain attack recently. Techcrunch reports dozens of WordPress plugin packages have been compromised via a social engineering style attack. It is important to be diligent about updates applied and review them over time. While very rare, it can even happen with plugins to WordPress that are often widely used.

By reviewing updates often, using known good sources of downloads, and configuring systems to use packages 24 hours to 1 week older than the latest, we can mitigate many supply chain exploits used by groups to steal data and spread malware. Stay tuned for the next post when we cover more about WordPress and security for your site