Unverified50% confidenceFactExact time
Mainstream repositories such as RubyGems, npm, and PyPI have all experienced incidents of malicious package uploads and account hijacking.
1
Sources
50%
Confidence
Long-term
Relevance
9/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedHundreds of malicious and spam packages were uploaded to RubyGems, causing severe service disruptions to the platform.77% similarUnverifiedMany malicious packages exploited RubyDoc.info's documentation build process to steal data from UK government websites.65% similarUnverifiedIn historical reports on mainstream bug bounty platforms such as HackerOne and Bugcrowd, exposed configuration files and .git directories are among the most frequently rewarded high-value vulnerability types.63% similarUnverified恶意开发者的供应链攻击包括域名近似劫持、工具名称冲突、偏好诱导攻击、工具投毒、跑路服务、跨服务器影子劫持、命令注入等62% similarUnverifiedMainstream bug bounty platforms include HackerOne, Bugcrowd, and Intigriti, with participating companies spanning Google, Meta, and Microsoft.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/920098API
curl https://kongchang.com/api/v1/knowledge/claims/920098MCP
get_claim(id=920098)