Blind Spots in the Build: A Supply Chain & SBOM Security Primer

**Executive Summary:** This report explains the growing risk of software supply-chain compromises, illustrates real-world incidents (the Shai-Hulud NPM worm that propagated across packages, stole credentials and crypto, and included destructive fallback behavior, and the widespread Log4Shell RCE exploitation), and recommends defenses including Software Bill of Materials (SBOMs), Vulnerability Exploitability eXchange (VEX) documents, build provenance/SLSA, and regulatory measures to improve visibility and response.