Unverified50% confidenceFactExact time
此前 ua-parser-js、coa、rc 等包的供应链攻击中已多次观察到类似的凭证外泄模式
1
Sources
50%
Confidence
Long-term
Relevance
8/7/2026
First Seen
Sources
Related Claims
Unverified由于 .pth 载荷在 import 之前执行，Bandit 等静态分析工具和基于 import hook 的运行时监控方案难以捕获此类攻击61% similarUnverified智能体供应链风险主要发生在运行时动态加载有漏洞的组件，使传统的'一次扫描、持续信任'模式失效60% similarUnverifiedIn the 2021 ua-parser-js poisoning incident, an attacker hijacked the package maintainer's account and injected a mining program and a password stealer into three versions; affected downstream projects included internal tools of major tech companies such as Facebook and Microsoft.60% similarUnverified该漏洞与供应链攻击结合后，攻击者只需在热门开源包中夹带伪装的git.exe，便可在全球数以万计的Cursor用户机器上无声触发执行59% similarUnverified2023年前后安全研究人员记录了多起利用Unicode双向控制字符（BiDi）实现视觉欺骗的真实供应链攻击案例58% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/704138API
curl https://kongchang.com/api/v1/knowledge/claims/704138MCP
get_claim(id=704138)