Unverified50% confidenceFactExact time
Historically, npm packages such as event-stream and ua-parser-js have experienced supply chain security incidents.
1
Sources
50%
Confidence
Long-term
Relevance
10/3/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedHistorically, the npm event-stream incident (2018) and the PyPI ctx poisoning incident (2022) both caused widespread supply chain attack impacts.66% similarUnverifiedOpen-source supply chain security incidents in recent years include malicious package poisoning in the npm ecosystem, phishing attacks on PyPI, and the XZ Utils backdoor incident.65% similarUnverifiedEcosystems such as npm and PyPI have experienced supply chain attacks in which core packages were injected with malicious code or maintainer accounts were hijacked.65% similarUnverifiedCommon techniques in NPM supply chain attacks include typosquatting, hijacking abandoned legitimate packages, and phishing to obtain maintainer account credentials before injecting malicious versions.65% similarUnverifiedThe event-stream malicious package incident in the npm ecosystem demonstrated the destructive power of dependency chain poisoning, where an attacker took over a small library and injected malicious code into downstream projects.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/970158API
curl https://kongchang.com/api/v1/knowledge/claims/970158MCP
get_claim(id=970158)