I feel like I probably got this idea from someone else but I wish we would use the term "dependency attack" rather than "supply chain attack." To me it feels like it puts the accountability more on the one who decides to incorporate a dependency and less on the person whose software was likely used without compensation of any kind.