Instead of attacking thousands of companies one by one, attackers compromise something thousands of companies trust: a software package, an update, or a service provider.

How it works

– Software packages: attackers hijack a maintainer’s account or build process and publish a malicious version of a popular library

– Developer tools and extensions: compromised plugins, scanners, or build tools run inside trusted environments

– Service providers: a breach at a vendor, analytics tool, or outsourced call center exposes its customers’ data

– Stolen tokens: access keys harvested in one incident are reused later against other targets

2026 examples

Security researchers reported a wave of open-source package compromises in 2026, including popular npm packages and developer tools. One reported incident involving the LiteLLM AI framework in March 2026 potentially exposed more than 2,500 organizations, according to CloudSEK, and an FBI advisory in July warned that stolen credentials from such campaigns could be used long after the initial breach. Other reports described compromises of tools such as Trivy and TanStack packages. Breaches at third-party vendors were also linked to data theft at banks and other firms.

Why it matters to small businesses

– You may not write code, but your software suppliers and managed services do

– A vendor’s weak security becomes your risk

– You often can’t see inside their systems

How to reduce risk

1. Inventory your vendors, and know which have access to your data or systems

2. Ask security questions: MFA, patching, incident notification, certifications

3. Limit access: give vendors only what they need, with separate accounts and logging

4. Review integrations and OAuth apps regularly

5. Pin and verify software versions and avoid automatically installing brand-new releases of critical packages

6. Monitor for unusual activity from vendor accounts

7. Plan for vendor incidents: know who to call and what you’d do

8. Include security terms in contracts, such as breach notification timelines

If you have an IT provider

Ask how they protect their own tools, since an MSP’s remote access and management platforms are high-value targets.

Sources: CloudSEK research (2026)

DBR Soft can help you review vendor risk and tighten third-party access. Contact us for more information.