I personally like the metaphor (but then again I work on a major package manager). I like to think of it this way... - we download code - from the internet

I personally like the metaphor (but then again I work on a major package manager). I like to think of it this way... - we download code - from the internet - written by unknown individuals - that we haven't read - which we execute - with full permissions - on our trusted devices - where we keep our most important data (someone wrote this that I found in the SSC space) Given a supply chain attack can happen at many of those steps above, but is also extended to source code, build systems, and production services, it's a great metaphor for visualizing the complex "software supply chain".