So fwiw I think the whole concept of the "software supply chain" actually stems from "supply chain" attacks. It's kind of like once that turn of speech entered the fray, suddenly there was a software supply chain (for OSS).