Unverified50% confidenceFactExact time

npm的lifecycle脚本（preinstall、install、postinstall）会在npm install时自动执行，是供应链攻击最常被滥用的技术特性之一

1

Sources

50%

Confidence

Long-term

Relevance

7/13/2026

First Seen

Sources

jscrambler npm包遭投毒：供应链攻击应急响应与防护指南

redditr/programming7/11/2026

Related Claims

Unverifiednpm、PyPI等主要包管理平台已逐步整合Sigstore64% similar Unverified该项目计划上传到NPM仓库实现一键安装62% similar Verifiednpx是npm 5.2+内置的包执行工具，允许开发者无需全局安装即可直接运行任意npm包60% similar Verifiednpm（Node Package Manager）是Node.js附带的包管理器，用于下载和管理项目所需的第三方代码库56% similar

Cite This Claim

Stable URI

https://kongchang.com/claim/500923

API

curl https://kongchang.com/api/v1/knowledge/claims/500923

MCP

get_claim(id=500923)