Unverified85% confidenceFactExact time
2021年的ua-parser-js事件中，攻击者入侵单个被广泛使用的npm包，一次性影响了数以万计的下游项目
1
Sources
85%
Confidence
Long-term
Relevance
5/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe ua-parser-js incident of 2021 and the node-ipc incident of 2022 demonstrated that attackers can target the entire downstream ecosystem by tampering with dependency packages or injecting malicious dependencies.79% similarUnverifiedIn the 2021 ua-parser-js poisoning incident, an attacker hijacked the package maintainer's account and injected a mining program and a password stealer into three versions; affected downstream projects included internal tools of major tech companies such as Facebook and Microsoft.69% similarUnverified2021年曝光的QNAP NAS勒索软件事件（eCh0raix/QNAPCrypt）中，攻击者利用暴露在公网的管理界面实施攻击，感染量超过数万台68% similarUnverifiedThe 2020 SolarWinds incident and the 2021 Codecov incident are classic examples of supply chain attacks, in which attackers infected users at scale by compromising software distribution channels.66% similarUnverified2023年MOVEit文件传输平台的零日漏洞攻击导致超过2000家组织受到影响，波及超过6000万人的数据66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/6990API
curl https://kongchang.com/api/v1/knowledge/claims/6990MCP
get_claim(id=6990)