Digital Supply-Chain Breaches and Physical Commodity Chokepoints Share the Same State-Sponsored Leverage Play

The TanStack compromise that exfiltrated 170 private repos, the WaterPlum/North Korean laptop-farm operation hitting 30,000 devices, and the SideCopy LNK/mshta campaign targeting Indian academia are reported as isolated security incidents. Yet they follow the identical pattern visible in the physical domain: China’s 21 % drop in rare-earth magnet shipments to the US ahead of Trump-Xi talks, the diversion of F-35 components through Hong Kong, and Iran’s Hormuz posturing that spikes diesel above $6.50/gal for U.S. farmers. In each case a single upstream actor (state or proxy) exploits a transitive dependency—code library, hardware component, or maritime strait—to create asymmetric cost and availability shocks that downstream institutions must absorb without clear recourse. The Factum’s siloed desks never connect the 313 Bureau’s IT-worker farms to China’s magnet export data or to Houthi warnings over Saudi pipelines, even though all three convert control of an intermediate node into measurable downstream scarcity.