Expired60% confidenceFactExact time
In 2018, the npm ecosystem saw the event-stream incident, in which a widely depended-upon open-source package had cryptocurrency wallet-stealing code injected by a malicious maintainer, affecting millions of downloads.
2
Sources
60%
Confidence
Medium-term (~90 days)
Relevance
7/2/2026
First Seen
Valid until: 9/30/2026(expired)
Sources
GitHub AI Weekly: Agent Ecosystem Support Tools Explode onto the Scene
bilibiliAIlazy俊6/15/2026
Related Claims
VerifiedIn the 2018 event-stream incident, an attacker took over the maintenance rights of an npm package and implanted malicious code to steal Bitcoin wallet private keys; the package had over 2 million weekly downloads.76% similarUnverifiedIn the ctx package incident of 2022, an attacker hijacked a package with millions of downloads and stole sensitive information such as AWS keys.68% similarUnverifiedEcosystems such as npm and PyPI have experienced supply chain attacks in which core packages were injected with malicious code or maintainer accounts were hijacked.67% similarVerifiedIn 2021, the npm package ua-parser-js (with over 7 million weekly downloads) had cryptocurrency mining software planted in it after the original author's account was hijacked.66% similarUnverifiedSecurity incidents including the large-scale cryptocurrency mining attack of 2018 and the Mēris botnet both involved compromised MikroTik routers.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/44308API
curl https://kongchang.com/api/v1/knowledge/claims/44308MCP
get_claim(id=44308)