Unverified50% confidenceFactExact time
Ecosystems such as npm and PyPI have experienced supply chain attacks in which core packages were injected with malicious code or maintainer accounts were hijacked.
1
Sources
50%
Confidence
Long-term
Relevance
9/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe event-stream malicious package incident in the npm ecosystem demonstrated the destructive power of dependency chain poisoning, where an attacker took over a small library and injected malicious code into downstream projects.76% similarUnverifiedOpen-source supply chain security incidents in recent years include malicious package poisoning in the npm ecosystem, phishing attacks on PyPI, and the XZ Utils backdoor incident.71% similarUnverified恶意开发者的供应链攻击包括域名近似劫持、工具名称冲突、偏好诱导攻击、工具投毒、跑路服务、跨服务器影子劫持、命令注入等68% similarUnverifiedSupply chain attacks plant malicious code indirectly by contaminating third-party libraries that a project depends on, rather than directly breaching the target project68% similarUnverifiedIn 2018, the npm ecosystem saw the event-stream incident, in which a widely depended-upon open-source package had cryptocurrency wallet-stealing code injected by a malicious maintainer, affecting millions of downloads.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/920484API
curl https://kongchang.com/api/v1/knowledge/claims/920484MCP
get_claim(id=920484)