A repository supply chain is the set of code, configuration files, scripts, assets, and automation delivered through a code-hosting project. Its risk is broader than malicious source files: project settings may influence how developer tools behave when someone clones or opens a repository.
Attackers can hide executable content among ordinary-looking assets or use editor tasks and build scripts to provide an execution path. For defenders, a suspicious file’s presence does not prove it ran; check configuration changes, workspace trust decisions, and endpoint telemetry to establish execution and impact. Review repository automation before running it, and inspect unfamiliar projects in a controlled environment.