Supply Chain Compromise
Adversaries may manipulate products or product delivery mechanisms prior to receipt by the end user to achieve data or system compromise.
As software development strongly relies on popular open source projects and package manager repositories that are used as dependencies in many applications, these become targets for attackers as means to add malicious code to users of the dependency.  
For the adversaries, shifting "upstream" in the software supply chain increases the number of targets and the chances for a successful infection.
Supply chain compromise can take place at any stage of the supply chain including:
- Software development tools
- Software development environment
- Public or private source code repositories
- Source code in open source dependencies
- Software update/distribution mechanisms
- System and container images 
- Modified/counterfeit products to legitimate distributors
- Shipment interdiction.
While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.   
To achieve this goal, adversaries may target the company’s software development or distribution pipeline, and compromise the Code Signing process, modifying the code distributed to the end user.
A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.
Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. Perform physical inspection of hardware to look for potential tampering.
- Trendmicro. (2018, November 29). Hacker Infects Node.js Package to Steal from Bitcoin Wallets. Retrieved April 10, 2019.
- MITRE ATT&CK
- IBM Support. (2017, April 26). Storwize USB Initialization Tool may contain malicious code. Retrieved May 28, 2019.
- Schneider Electric. (2018, August 24). Security Notification – USB Removable Media Provided With Conext Combox and Conext Battery Monitor. Retrieved May 28, 2019.
- Avast Threat Intelligence Team. (2018, March 8). New investigations into the CCleaner incident point to a possible third stage that had keylogger capacities. Retrieved March 15, 2018.
- Windows Defender Research. (2018, March 7). Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign. Retrieved March 20, 2018.
- Command Five Pty Ltd. (2011, September). SK Hack by an Advanced Persistent Threat. Retrieved April 6, 2018.
- O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved February 15, 2018.
- OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.