Definition
Websites load scripts from analytics services, ad networks, content delivery networks, and plugins. Games load packages, native plugins, and SDKs the same way. An attacker who changes one of those shared pieces changes every site or build that embeds it. The payload arrives through the dependency, while the owner's own source can stay as it was.
Relevance
A tracking script on the game's website, a CMS plugin, or a package in the Unity project is a single place that reaches every visitor of that page or every player of that build. Pinning the version, and checking who can publish it, limits that path.
Example
An analytics script embedded on the studio site is altered at the vendor. Every page that includes the script starts loading a hidden frame. The studio's own templates were not edited.
Connected
Synonyms
Software supply chain attack