From backdoored JavaScript libraries to AI vendor governance, third party risk now spans software, hardware, developer tools, and geopolitical dimensions.