Verified65% confidenceFactExact time
Common techniques in NPM supply chain attacks include typosquatting, hijacking abandoned legitimate packages, and phishing to obtain maintainer account credentials before injecting malicious versions.
3
Sources
65%
Confidence
Long-term
Relevance
9/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedEcosystems such as npm and PyPI have experienced supply chain attacks in which core packages were injected with malicious code or maintainer accounts were hijacked.78% similarUnverified恶意开发者的供应链攻击包括域名近似劫持、工具名称冲突、偏好诱导攻击、工具投毒、跑路服务、跨服务器影子劫持、命令注入等72% similarUnverifiedOpen-source supply chain security incidents in recent years include malicious package poisoning in the npm ecosystem, phishing attacks on PyPI, and the XZ Utils backdoor incident.70% similarUnverifiedThe event-stream malicious package incident in the npm ecosystem demonstrated the destructive power of dependency chain poisoning, where an attacker took over a small library and injected malicious code into downstream projects.69% similarUnverifiedSupply chain poisoning can contaminate upstream resources automatically consumed by Agents by embedding prompt injection instructions in the description fields of public npm/PyPI packages or by submitting Pull Requests containing malicious comments to open-source repositories.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/939483API
curl https://kongchang.com/api/v1/knowledge/claims/939483MCP
get_claim(id=939483)