nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types

A four-year study found that all 50 examined software and device platform types contain a critical supply-chain vulnerability in their runtime client-side rendering process, with 46 rated Critical or High risk. The core danger is that any compromised supplier in the rendering chain can manipulate what users see or what software does *after* all security checks have already passed, making traditional defenses ineffective. The 2024 Polyfill.io incident demonstrated this at scale, where a compromised third-party JavaScript library silently altered behavior for millions of users. This matters because organizations typically audit their direct vendors but rarely map or monitor the full dependency chain of every component rendered at runtime. Without visibility into these transitive dependencies, attackers can silently manipulate data, suppress safety alerts, or inject disinformation into trusted interfaces.