Unverified50% confidenceEventExact time
In the 2021 ua-parser-js incident, attackers took over the account and injected a cryptocurrency mining program.
1
Sources
50%
Confidence
Long-term
Relevance
9/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn the 2021 ua-parser-js poisoning incident, an attacker hijacked the package maintainer's account and injected a mining program and a password stealer into three versions; affected downstream projects included internal tools of major tech companies such as Facebook and Microsoft.80% similarVerifiedIn 2021, the ua-parser-js supply chain attack occurred, in which attackers compromised a maintainer's account to publish a malicious version.78% similarUnverifiedThe ua-parser-js incident of 2021 and the node-ipc incident of 2022 demonstrated that attackers can target the entire downstream ecosystem by tampering with dependency packages or injecting malicious dependencies.78% similarUnverified2021年的ua-parser-js事件中，攻击者入侵单个被广泛使用的npm包，一次性影响了数以万计的下游项目76% similarVerifiedIn 2021, the npm package ua-parser-js (with over 7 million weekly downloads) had cryptocurrency mining software planted in it after the original author's account was hijacked.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/939485API
curl https://kongchang.com/api/v1/knowledge/claims/939485MCP
get_claim(id=939485)