Expired50% confidenceFactExact time
The ua-parser-js incident of 2021 and the node-ipc incident of 2022 demonstrated that attackers can target the entire downstream ecosystem by tampering with dependency packages or injecting malicious dependencies.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
7/2/2026
First Seen
Valid until: 9/30/2026(expired)
Sources
Related Claims
Unverified2021年的ua-parser-js事件中，攻击者入侵单个被广泛使用的npm包，一次性影响了数以万计的下游项目79% similarUnverifiedThe event-stream malicious package incident in the npm ecosystem demonstrated the destructive power of dependency chain poisoning, where an attacker took over a small library and injected malicious code into downstream projects.70% similarUnverified2021年曝光的QNAP NAS勒索软件事件（eCh0raix/QNAPCrypt）中，攻击者利用暴露在公网的管理界面实施攻击，感染量超过数万台67% similarUnverifiedThe attacker planned to use the zero-day vulnerability to bypass a two-factor authentication (2FA) mechanism on an undisclosed platform and launch a large-scale exploitation event.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/52841API
curl https://kongchang.com/api/v1/knowledge/claims/52841MCP
get_claim(id=52841)