一句话：本文讨论软件供应链攻击从利用既有漏洞转向直接向开源依赖与构建部署植入恶意代码的趋势与影响。
软件组织普遍未能预见软件供应链（SSC）会成为蓄意攻击途径。攻击者已从发现并利用善意开发者引入的漏洞（如 Log4j），转向新一代供应链攻击：主动将漏洞或恶意代码直接植入开源依赖。类似 SolarWinds 的事件还表明，攻击者可渗透构建与部署流程来分发恶意软件。一旦植入，这些漏洞便成为攻击者大规模利用供应链获取杠杆的高效途径。自 2020 年以来，软件供应链攻击呈指数增长。本文围绕这一趋势提出关切，探讨软件工程界应如何应对。
Software organizations largely did not anticipate how the software supply chain (SSC) would become a deliberate attack vector. Attackers have moved from finding and exploiting vulnerabilities contributed by well-intentioned developers, such as log4j, to a new generation of software supply chain attacks, aggressively implanting vulnerabilities directly into dependencies available in open source. As with SolarWinds, adversaries also find their way into builds and deployments to deploy rogue software. Once implanted, these vulnerabilities become an efficient attack vector for adversaries to gain leverage at scale by exploiting the software supply chain. Software supply chain attacks have increased exponentially since 2020.