Almost no software today is written from scratch. Your website, your apps, and the tools you rely on are assembled from thousands of pieces of third-party code, plugins, libraries, and packages, most of it maintained by people you have never heard of and updated on its own schedule. That is efficient and normal. It also means a weakness or a malicious change in any of those pieces can reach your business without a single line of your own code changing. This is software supply-chain risk, and it is worth understanding even if you never write code.
How the risk reaches you
You do not have to be a software company to be exposed. If you run a WordPress site, it is built on plugins and themes maintained by others, and a compromised one can hand attackers your site, as the BdThemes incident showed. If you use SaaS tools, they are built on the same kind of shared components. Attackers have learned this is a force multiplier: poison one popular package and you reach everyone who uses it, which is exactly what recent waves of attacks on open-source package registries have done, some spreading automatically from one project to the next.
Why it is hard to see
The unsettling part is that this risk hides behind trust. The compromised code arrives through a normal, expected update from a source you rely on, so nothing looks wrong, your files may be current and your scanners quiet, while the danger came in through a channel you were right to trust. That is what makes supply-chain attacks different from a typical hack: the front door was legitimate.
What a small business can actually do
- Reduce your surface. Every plugin, extension, and add-on is supply-chain exposure. Use fewer, from reputable sources, and remove what you do not need.
- Keep things updated, but watch for the exceptions. Patching is still right, but be alert to advisories about a specific compromised component, sometimes the fix is to remove or roll back, not update.
- Limit the blast radius. Least-privilege access and separation mean a compromised component reaches less.
- Have monitoring and a way back. Since prevention cannot be perfect, being able to detect trouble and recover matters as much as keeping it out.
The mindset shift
You cannot audit the world's code, and you do not need to. The shift is to recognize that the tools you trust are themselves built on things you are trusting by extension, so "keep everything updated" is necessary but not sufficient. Favour fewer, well-maintained components, stay alert to supply-chain advisories, and make sure that if something does slip through a trusted channel, it cannot reach everything and you can recover. That is a realistic posture for a small business, and it ties directly to how you choose and trust vendors in the first place.