Supply-chain attacks
Also known as: supply chain · dependency attack
A supply-chain attack compromises something you depend on — a package, a model file, an MCP server, a tool — rather than your own code.
- A malicious PyPI/npm package.
- A poisoned model weights file.
- A rogue MCP server or tool.
Why AI is a target: the more third-party models, tools, and servers you wire in, the bigger the supply-chain surface. Verify provenance; pin versions; audit dependencies.