TL;DR:

  • Supply chain attacks target the software and tools you trust, not your systems directly — attackers compromise a tool’s update or dependency chain to reach all its users at once
  • May 2026 saw three major supply chain attacks added to CISA’s exploitation catalogue in a single day: a developer VS Code extension, a JavaScript library ecosystem, and a Windows disc utility — all with legitimate-looking signatures and certificates
  • Small businesses are collateral damage in these attacks, but the practical defences — knowing what software you run, keeping it updated, and reviewing access after any compromise — are achievable without a security team

You’ve probably heard about supply chain attacks in the context of large organisations — the SolarWinds breach in 2020, the 3CX compromise in 2023. The common framing is that these are nation-state operations targeting governments and big corporations, not something small businesses need to worry about.

That framing is increasingly wrong. The May 2026 supply chain attacks that hit developer tooling used by thousands of UK businesses — and contributed to a breach of GitHub’s internal systems — spread indiscriminately. Any organisation running the affected software was at risk. Size didn’t matter.

What a Supply Chain Attack Actually Is

Here’s the core idea. You trust your bank. You trust the software your bank tells you to install. An attacker who wants to steal from you figures out that it’s much easier to compromise the software maker than to attack you directly.

In software terms: every application you run depends on other software components that were built by other people. Your accounting software uses libraries. Your developer’s code editor has extensions. Your VPN client updates itself automatically. Each of those dependencies is a potential entry point.

A supply chain attack compromises one of those trusted components — not your systems, but something you use — and rides it in. Because your security controls are set up to trust updates from known software vendors, and because the malicious version is often cryptographically signed with the real vendor’s certificate, it looks completely legitimate right up until it’s not.

What Happened in May 2026

Three separate supply chain attacks were confirmed as actively exploited in a single CISA bulletin on 27 May 2026.

Nx Console, a VS Code extension used by developers working with certain JavaScript frameworks, had a malicious version published for about 20 minutes. That was long enough to reach developer machines at organisations including GitHub itself. The extension, when activated, swept credentials off developer workstations — cloud service access keys, code repository tokens, password manager contents.

TanStack npm packages — JavaScript libraries used in web development — were similarly compromised through a sophisticated attack on the project’s automated publishing system. Malicious versions were published that ran credential-stealing code when installed.

DAEMON Tools Lite, a popular Windows utility for mounting disc images, had its official installer replaced with a backdoored version for nearly a month. The malicious installer was signed with the legitimate vendor’s certificate. Any Windows machine that downloaded and installed DAEMON Tools from the official site during that window has persistent malware that activates on startup and can download additional payloads.

Your business may not use these specific tools. But the underlying pattern — legitimate software, compromised distribution, malicious payload — is repeating across dozens of products every year.

Why Small Businesses Are in the Crosshairs

Supply chain attackers typically aim at high-value targets: developers at large organisations, financial systems, CI/CD pipelines. But the attacks spread to everyone running the compromised software. If your web developer uses an affected library, your developer’s machine may have been swept for credentials. If your office runs DAEMON Tools for some legacy reason, you’ve got a persistent backdoor.

The economic logic is also shifting. Credential-stealing malware has become easier to monetise. Stolen cloud credentials, email accounts, and financial system access all have ready buyers or can be used directly for fraud. You don’t have to be a high-value target to have something worth stealing.

What You Can Actually Do About It

The good news is that sensible, achievable practices significantly reduce your exposure. You don’t need a security team or expensive tooling.

Know what software you’re running. This sounds obvious but many small businesses have no clear picture of what’s installed on work devices, especially developer laptops or machines used by contractors. A basic software inventory — even a spreadsheet — means you can act quickly when a compromise is announced. When DAEMON Tools was flagged, organisations that knew whether they ran it could respond in hours; those that didn’t spent days finding out.

Set up an alert system for security advisories. The NCSC sends regular threat intelligence alerts. CISA’s KEV catalogue is public. Subscribe to security advisories for the software tools your business depends on. Many vendors also offer security mailing lists. When a compromise is announced, you want to know before a journalist does.

Review and limit what software can do. Software running on your machines doesn’t need to access everything. Applications that have no reason to reach cloud credentials, email accounts, or financial systems shouldn’t have permission to do so. Review what credentials are stored on devices and whether they’re necessary. Developer machines with access to production systems and financial services are high-value targets; consider whether that access needs to be as broad as it currently is.

Treat a suspected compromise seriously. If software you run is named in a security advisory, assume the worst and act on it rather than hoping for the best. That means rotating the credentials that were accessible from the affected device — not just the obvious ones, but everything: email, cloud services, financial accounts, password manager master passwords if the manager was running on the machine. It also means checking account activity for unusual access in the window the compromise was active.

Follow the NCSC’s 10 Steps to Cyber Security. The NCSC publishes practical guidance specifically designed for UK organisations of all sizes. The “managing software vulnerabilities” and “third-party supplier risk” sections are directly relevant to supply chain threats and are written to be actionable without a specialist security team.

The uncomfortable reality of supply chain attacks is that you can’t fully prevent them — that requires the software vendor to have secure development and distribution practices, and you can’t control that. What you can control is how quickly you detect and respond, how much damage a successful compromise causes, and whether your credential hygiene means an attacker who gets in finds something valuable or finds doors that are already locked.