Malicious Dependencies

Definition ∞ Malicious dependencies are external software components or libraries that have been intentionally compromised to include harmful code. When a project incorporates such a dependency, the malicious code becomes part of the final application, potentially leading to data theft, system control, or the introduction of backdoors. This vector represents a significant supply chain attack risk, particularly for decentralized applications relying on numerous open-source packages. The integrity of the software supply chain is critically undermined by their presence.
Context ∞ The prevalence of malicious dependencies is a growing concern in the software development landscape, especially within the fast-moving blockchain and Web3 sectors. News reports frequently detail incidents where popular libraries were tampered with, affecting countless projects. The industry is responding with increased scrutiny of third-party code, automated security scanning tools, and efforts to establish verifiable software supply chains to detect and prevent the inclusion of such components.