Unverified50% confidenceCautionExact time
For SDKs introduced via npm, common supply chain security risks include malicious versions published after a package is hijacked, asset files being replaced, and the dependency tree introducing insecure transitive dependencies; verifying asset integrity, locking versions and using a lockfile can reduce the risk
1
Sources
50%
Confidence
Long-term
Relevance
10/17/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedDevelopers can reduce the risk of dependency substitution through npm audit and lock files (package-lock.json / pnpm-lock.yaml).71% similarUnverifiedIn the context of npm supply chain attacks, combining signature verification, limiting publishing permissions, enabling npm Provenance, and auditing dependency changes in CI/CD can reduce the risk of supply chain attacks.70% similarUnverified2023 年的安全研究显示 npm 注册表中约 10% 的包包含安装脚本，部分执行下载运行外部二进制文件等高风险操作69% similarVerifiedPrivilege level and data access scope determine the severity of a vulnerability.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1050431API
curl https://kongchang.com/api/v1/knowledge/claims/1050431MCP
get_claim(id=1050431)