Comment by lapcat

This comment seems a bit confused.

A supply chain attack doesn't directly attack an end developer but rather a supplier of the developer. So who or what is the supplier in this case?