Compromising a dependency, build system, package registry or distribution channel so that malicious code reaches users through a trusted route.
Why it matters
In crypto this frequently means a JavaScript package loaded at runtime by a dapp front end. Because the code arrives through the legitimate path, no domain check, certificate check or bookmark protects against it.
What you can check
The compromise is upstream of the project, in something it depends on — a package, a build step, a hosted script. Projects that publish subresource integrity hashes, pinned dependency versions and reproducible builds are making a checkable claim; projects that do not are asking for trust.
Where it showed up
Records in the Incident Tracker that turn on this: Ledger Connect Kit supply chain attack and Bybit cold wallet compromise.
Not advice. Definitions are for understanding, not instruction. Nothing here is financial, legal, tax or security advice.