What the phrase covers
The digital supply chain is the set of third-party code and services an organization embeds in its own assets: an analytics script, a library served from a CDN, a support widget, a marketing pixel, an API the page calls to function.
The difference from ordinary supplier risk is where the thing executes. A cloud provider runs on its own infrastructure. A third-party script runs inside your page, in your customer's browser, with your brand in the address bar.
Why it is hard to see
Nobody approves this chain in one go.
Marketing adds a pixel to measure a campaign. Product adds a library to handle date formatting. A team integrates a chat because support asked. Each decision went through the process that existed for it, and none went through an inventory of the whole.
The aggravator is depth. The script you approved loads another script, which loads a third. The tree grows downward and the organization sees only the first level, which is what someone wrote in the tag.
What happens when a link is compromised
The compromise does not need to touch your infrastructure.
Whoever controls the domain serving that file controls what runs on your page. The visitor receives the malicious code from your site, with your certificate, and no log on your server shows anything abnormal, because the server delivered exactly what it always delivers.
The Polyfill.io case is the exemplar: a widely adopted library changes hands, the new owner alters what the file delivers, and millions of sites start serving it with no change on their side. The case is described in detail.
How to inventory it
From outside, watching what the page itself loads when it opens.
That is the only way to catch the whole tree, because it assembles at runtime and appears in no code repository. What the browser fetches is the real inventory, and it changes when a third party decides to change it.
The first survey usually surprises by its size. It is common to find dozens of third-party domains being contacted by a page the company considered simple.
What to do with the list
Removing what no longer serves is the highest-return move, and there is always plenty. A pixel from a closed campaign, a library for a feature that went offline, a tag for a tool the company stopped using.
For what stays, two controls reduce damage without requiring trust in the third party: pin the version instead of pointing at latest, and verify file integrity on load.
This differs from third-party risk management, which deals with the supplier organization's posture. Here the object is the artifact executing inside your asset, and it arrives with no contract signed.