Unverified50% confidenceBenchmarkExact time
2023 年的安全研究显示 npm 注册表中约 10% 的包包含安装脚本，部分执行下载运行外部二进制文件等高风险操作
1
Sources
50%
Confidence
Long-term
Relevance
8/18/2026
First Seen
Sources
Related Claims
UnverifiedIn 2021, the npm package ua-parser-js (with over 7 million weekly downloads) had cryptocurrency mining software planted in it after the original author's account was hijacked.65% similarVerifiedThe cause of the leak was the development team's failure to correctly configure .npmignore rules during packaging, resulting in source code files being uploaded to the npm registry.60% similarUnverified2023年的研究表明，主流LLM生成的代码中约有40%存在某种程度的安全漏洞60% similarUnverified使用他人打包的Skill文件存在安全风险，可能引入恶意指令58% similarUnverified哈佛大学与Linux基金会的研究显示，不到10%的开源维护者贡献了超过90%的安全相关代码提交57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/767641API
curl https://kongchang.com/api/v1/knowledge/claims/767641MCP
get_claim(id=767641)