Unverified50% confidenceEventExact time
During the left-pad incident experienced by the Node.js community in 2016, a package with only 11 lines of code was unpublished from npm by its author, causing thousands of projects to fail to build.
1
Sources
50%
Confidence
Long-term
Relevance
9/2/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedDuring the left-pad incident of 2016, after an npm package of only 11 lines of code was deleted by its author, tens of thousands of CI/CD pipelines around the world simultaneously attempted to reinstall dependencies, placing enormous pressure on the npm registry.64% similarUnverified2016年left-pad事件中，一个仅11行代码的npm包导致互联网局部瘫痪60% similarVerifiedIn 2021, the npm package ua-parser-js (with over 7 million weekly downloads) had cryptocurrency mining software planted in it after the original author's account was hijacked.59% similarUnverified2023 年的安全研究显示 npm 注册表中约 10% 的包包含安装脚本，部分执行下载运行外部二进制文件等高风险操作58% similarUnverifiedIn 2022, the node-ipc malicious code incident occurred, in which a well-known open-source package was implanted with destructive code57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/844420API
curl https://kongchang.com/api/v1/knowledge/claims/844420MCP
get_claim(id=844420)