Unverified50% confidenceEventExact time
2020年的event-stream事件中，一个每周下载量逾200万次的npm开源包被转让后被植入恶意代码
1
Sources
50%
Confidence
Long-term
Relevance
7/6/2026
First Seen
Sources
Payload-Less Skills: The Hidden Supply Chain Threat Targeting LLM Agents
hackernewshackernews7/4/2026
Related Claims
UnverifiedAs of 2024, the npm registry hosts more than 2.5 million packages, with over 50 billion downloads per week.70% similarUnverifiedtokio is the de facto standard async runtime for Rust programming; as of 2024, its average monthly download count has exceeded 150 million.69% similarUnverifiedThe 2021 ua-parser-js supply chain attack affected a package with over 8 million weekly downloads.66% similarUnverifiedRemotion's NPM weekly download count has reached 940,000.65% similarUnverified在 2021 到 2023 年间，Tailwind 的 npm 周下载量从数百万激增至数千万64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/113893API
curl https://kongchang.com/api/v1/knowledge/claims/113893MCP
get_claim(id=113893)