Verified70% confidenceEventExact time
In 2021, the npm package ua-parser-js (with over 7 million weekly downloads) had cryptocurrency mining software planted in it after the original author's account was hijacked.
4
Sources
70%
Confidence
Long-term
Relevance
7/7/2026
First Seen
Sources
200KB Minimalist CI/CD Tool: A Lightweight Deployment Solution for Indie Developers to Ditch Jenkins
bilibiliAdestikla6/22/2026
Related Claims
UnverifiedIn the ctx package incident of 2022, an attacker hijacked a package with millions of downloads and stole sensitive information such as AWS keys.70% similarUnverifiedIn the 2021 ua-parser-js incident, attackers took over the account and injected a cryptocurrency mining program.68% similarUnverified2023 年的安全研究显示 npm 注册表中约 10% 的包包含安装脚本，部分执行下载运行外部二进制文件等高风险操作65% similarUnverified2024年以来已有多起AUR包被发现包含加密货币挖矿脚本或信息窃取程序的事件65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/129596API
curl https://kongchang.com/api/v1/knowledge/claims/129596MCP
get_claim(id=129596)