The year 2025 consolidated a transition that any organization's risk committee needs to record in its minutes: the supply chain attack ceased to be an exceptional event and became part of the baseline of corporate cyber risk. The figures published by threat intelligence vendors and by industry reports converge on the same reading. The volume of incidents originating in third parties doubled relative to 2024, the aggregate cost reached tens of billions of dollars per year, and entire sectors of the real economy came to operate under a materially higher exposure profile.
This document examines what changed in the supply chain vector, presents the public cases that defined the period, and proposes an exposure-reduction agenda appropriate for boards of directors, audit committees, and information security functions.
What the 2025 Data Establishes
The report from the x63 unit of the Cipher/Prosegur Group estimates the aggregate cost of software supply chain attacks at more than US$53.2 billion per year, with global incidents doubling in 2025 on an annual basis and an average cost close to 4.33 million euros per event. The same study indicates that 22.5% of all breaches recorded in 2025 involved third parties or suppliers — double the proportion observed in the prior year (Prosegur).
The trend is corroborated by independent sources. The Verizon 2025 Data Breach Investigations Report identified the doubling of the third-party share of breaches, rising from approximately 15% to 30% within a single annual cycle — a movement attributed to the mass exploitation of file transfer software, to credential reuse across supplier ecosystems, and to the maturation of the access broker markets (Help Net Security).
The financial component deserves particular attention from the audit committee. According to the IBM Cost of a Data Breach Report 2025, a compromise originating in the supply chain costs, on average, US$4.91 million and takes 267 days to be identified and contained — the longest lifecycle among all breach vectors tracked by the study. The prolonged detection time amplifies the operational, economic, and reputational impact, and constitutes, in itself, an indicator that traditional perimeter controls do not reach the risk introduced by suppliers.
The sectoral distribution reinforces the materiality. The manufacturing sector recorded a 61% year-over-year growth in attacks, ranking among the most affected alongside technology and retail — segments characterized by high interconnection and by extensive, globalized supply chains (Prosegur). For industrial organizations, the convergence between information technology and operational technology makes each embedded software supplier, each open source component, and each third-party integrator an entry point with the potential to disrupt production.
What Changed: From the Point Intrusion to Automated Propagation
The qualitative distinction of 2025 lies in the degree of automation and self-propagation of the attacks. The open source ecosystem, on which most modern corporate software rests, became the principal theater of operations.
The most representative episode was the worm identified as Shai-Hulud. Beginning on September 15, 2025, malicious versions of multiple popular packages were published to the npm repository with a post-install script that harvested secrets, environment variables, and cloud keys, employing the TruffleHog tool to locate credentials and exfiltrating the data to public repositories created on GitHub under the name Shai-Hulud. The code exhibited worm behavior: upon finding additional npm tokens in the compromised environment, it automatically published malicious versions of every accessible package, propagating through the ecosystem without human intervention. This is the first documented successful self-propagating attack on npm and one of the most severe JavaScript supply chain incidents ever observed (Unit 42, Palo Alto Networks; Wiz). Its severity prompted a public CISA alert about the widespread compromise of the npm ecosystem (CISA).
In parallel, the IndonesianFoods campaign demonstrated a second face of the risk: the saturation of the repository. An automated spam payload published more than 100,000 packages to npm, generating new artifacts at intervals of a few seconds. The campaign began two years earlier, with tens of thousands of packages added in 2023, monetization implemented in 2024, and the self-replication mechanism introduced in 2025 (Sonatype; BleepingComputer). The effect is the degradation of trust in the repository itself and the expansion of the surface over which security teams must exercise vigilance.
The transition is clear. The adversary no longer depends on a manual intrusion into a specific target and now operates mechanisms that multiply on their own through the dependency relationships between packages and suppliers.
The Historical Context: The Trajectory to 2025
The doubling of 2025 has its roots in the incidents that structured the perception of third-party risk in prior years.
The MOVEit case, in 2023, remains a reference for scale. The exploitation of a vulnerability in the MOVEit Transfer file transfer software by the Cl0p group reached, by public estimates, thousands of organizations and tens of millions of individuals, with the data compromised at a single supplier propagating throughout its entire customer base. The episode established the pattern of mass exploitation of shared software that the 2025 DBIR would identify as one of the drivers of the doubling.
The Polyfill.io case, in 2024, illustrated the route of the trusted infrastructure provider. After the acquisition of the previously legitimate domain by a new operator, malicious code began to be injected into more than 110,000 websites that loaded scripts from the compromised CDN, with execution conditioned on specific devices to hinder detection. Even after the domain was removed, hundreds of thousands of hosts continued to reference the malicious script (Sansec; The Hacker News). The case demonstrated that a third-party asset embedded in the corporate front end — often forgotten in the footers of old pages — constitutes direct exposure.
The line connecting MOVEit, Polyfill.io, and Shai-Hulud is dependency: the organization inherits the risk of each supplier, library, and service it incorporates into its operation, and that risk materializes through paths the traditional perimeter does not observe.
An Exposure-Reduction Agenda
The appropriate response is the incorporation of third-party risk into the discipline of exposure management, with verifiable controls reviewed on a continuous basis. The following fronts compose an agenda that is defensible before the board.
- Complete inventory of the digital chain. Maintain an up-to-date mapping of software suppliers, service providers, open source components, and third-party assets embedded in applications and public pages. Exposure that is not inventoried is not managed.
- Software Bill of Materials (SBOM). Require and maintain the record of the dependencies of each critical application, so that the organization can answer, within hours, the question of which system uses a newly compromised component.
- Dependency hygiene and artifact integrity. Pin versions, verify signatures and package integrity, restrict the automatic execution of post-install scripts, and monitor abrupt changes in third-party libraries.
- Third-party access governance. Apply least privilege, segregated credentials, and regular rotation for supplier integrations, containing the reach of a compromised credential before it turns into lateral movement.
- Contractual clauses and continuous assessment. Establish security requirements, right-to-audit provisions, and incident notification obligations in contracts, and replace the annual supplier assessment with continuous monitoring of the corresponding public exposure profile.
- Response plans that account for the third party. Include supplier compromise scenarios in incident response exercises, considering that the average containment time for this vector exceeds 260 days and requires specific preparation.
Priority falls on reducing the interval between the introduction of an exposure in the chain and its identification. It is in this interval — measured in hundreds of days by the 2025 reports — that the cost of an incident accumulates.
Conclusion
The 2025 data recommends that supply chain risk be treated as its own category in corporate risk governance, with metrics, accountable owners, and periodic committee review. The doubling of the incident volume, the participation of third parties in nearly a quarter of breaches, and the aggregate cost in the tens of billions of dollars configure a material risk, defensible with public sources and independent of any alarmist reading. What the organization does not observe in its digital chain remains exposed until an adversary observes it first.
CSURFACE addresses this risk through the continuous management of the external attack surface and the mapping of the digital chain of third parties, offering security functions and committees an up-to-date view of the assets, suppliers, and dependencies exposed to the outside. The result is the reduction of the interval between the introduction of an exposure and its identification, and the ability to sustain risk decisions with verifiable evidence.
Sources
- Prosegur — Cyberattacks on the supply chain double by 2025, reaching annual global cost of $53.2 billion
- Help Net Security — Third-party breaches double, creating ripple effects across industries
- Unit 42 (Palo Alto Networks) — "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack
- Wiz — Shai-Hulud npm Supply Chain Attack
- CISA — Widespread Supply Chain Compromise Impacting npm Ecosystem
- Sonatype — Unprecedented automation: IndonesianFoods pits open source against itself
- BleepingComputer — New 'IndonesianFoods' spammer floods npm with 150,000 packages
- Sansec — Polyfill supply chain attack hits 100K+ sites
- The Hacker News — Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack