---
id: 1334
title: "Supply chain attacks are exploiting our assumptions"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2025/09/24/supply-chain-attacks-are-exploiting-our-assumptions/"
published_at: "2025-09-24 11:00"
tags: ["supply-chain", "pypi", "supply-chain-security", "typosquatting", "build-pipeline", "sbom", "trusted-publishing", "package-registry"]
phying_url: "https://phying.com/item/1334"
lang: en
---

# Supply chain attacks are exploiting our assumptions

## Summary

From typosquatting to poisoned pipelines, supply chain attacks exploit implicit trust in package registries; tools like TypoGard, Zizmor, and PyPI Trusted Publishing make trust verifiable.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2025-09-24 11:00
- **Original:** https://blog.trailofbits.com/2025/09/24/supply-chain-attacks-are-exploiting-our-assumptions/
- **Phying News:** https://phying.com/item/1334