Unverified70% confidenceEventExact time
The event-stream malicious package incident in the npm ecosystem demonstrated the destructive power of dependency chain poisoning, where an attacker took over a small library and injected malicious code into downstream projects.
2
Sources
70%
Confidence
Long-term
Relevance
7/12/2026
First Seen
Sources
Zero-Dependency AI Decision Record Auditor: A Practical Guide to Building Traceable AI Systems
hackernewshackernews7/9/2026
Related Claims
UnverifiedEcosystems such as npm and PyPI have experienced supply chain attacks in which core packages were injected with malicious code or maintainer accounts were hijacked.76% similarVerifiedCommon techniques in NPM supply chain attacks include typosquatting, hijacking abandoned legitimate packages, and phishing to obtain maintainer account credentials before injecting malicious versions.69% similarUnverifiedSupply chain attacks plant malicious code indirectly by contaminating third-party libraries that a project depends on, rather than directly breaching the target project69% similarUnverifiedOpen-source supply chain security incidents in recent years include malicious package poisoning in the npm ecosystem, phishing attacks on PyPI, and the XZ Utils backdoor incident.67% similarUnverifiedHistorically, npm packages such as event-stream and ua-parser-js have experienced supply chain security incidents.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/489213API
curl https://kongchang.com/api/v1/knowledge/claims/489213MCP
get_claim(id=489213)