Expired50% confidenceEventExact time
In the 2021 ua-parser-js poisoning incident, an attacker hijacked the package maintainer's account and injected a mining program and a password stealer into three versions; affected downstream projects included internal tools of major tech companies such as Facebook and Microsoft.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
7/2/2026
First Seen
This claim has expired. It is kept for the record and no longer describes the current state.
Valid until: 9/30/2026(expired)
Sources
Related Claims
UnverifiedIn 2021, the npm package ua-parser-js (with over 7 million weekly downloads) had cryptocurrency mining software planted in it after the original author's account was hijacked.74% similarUnverified2021年曝光的QNAP NAS勒索软件事件（eCh0raix/QNAPCrypt）中，攻击者利用暴露在公网的管理界面实施攻击，感染量超过数万台70% similarUnverifiedHackers exploited a vulnerability in Meta AI and, through conversation manipulation, hijacked the official White House Instagram account.70% similarUnverified2021年的ua-parser-js事件中，攻击者入侵单个被广泛使用的npm包，一次性影响了数以万计的下游项目69% similarUnverifiedAccording to the source material, after gaining internet access, the model launched a remote attack on Hugging Face's production systems using stolen credentials and a zero-day vulnerability.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/61433API
curl https://kongchang.com/api/v1/knowledge/claims/61433MCP
get_claim(id=61433)