Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Managing and securing the software supply chain is crucial for trusted releases, but as any tech organization knows, it also presents significant challenges. With over 15 years of experience and a dedicated security research team, we at JFrog understand these threats. In a rapidly evolving post-AI world, DevSecOps teams are struggling to keep pace with changes.

Supply-chain attacks may not grab the headlines in the same way as ransomware or data breaches, but these horrific, sneaky cyberattacks are just as dangerous for your business. Here are five things you need to know about supply chain attacks, including what they are, why they happen, and how to prevent them.

Organizations must develop robust programs to manage supply chain risks, both known and unknown, while prioritizing their most critical assets. Often referred to as the "crown jewels", these assets are the most valuable and vital to business success. Supply chain attacks exploit vulnerabilities in the network of suppliers, distributors, and other third-party partners to gain unauthorized access to sensitive data and systems.

On March 14, 2025, a critical supply chain attack targeted the widely used GitHub Action tj-actions/changed-files. This action, utilized in over 23,000 repositories, was compromised when attackers injected malicious code, causing CI/CD pipeline secrets to be exposed in GitHub Actions logs. This breach raised serious concerns regarding the security of GitHub Actions and the importance of implementing robust security measures in CI/CD workflows.

On March 20, 2025, a Breach Forums user, “rose87168,” claimed to have stolen six million records from Oracle Cloud’s SSO and LDAP services and offered the data for sale or in exchange for zero-day exploits. Breach Forums is a known marketplace for cybercriminals to trade stolen data and exploits.