Unverified50% confidenceFactExact time
The npm ecosystem has numerous prior supply chain attack incidents, including the ua-parser-js incident in 2021 and the deliberate sabotage of colors and faker in 2022.
1
Sources
50%
Confidence
Long-term
Relevance
10/11/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn 2021, popular npm packages such as ua-parser-js and colors were subjected to malicious code injection incidents.74% similarVerifiedThe ua-parser-js supply chain attack occurred in 2021.73% similarUnverified2022年colors.js和faker.js事件中，维护者Marak Squires在代码中注入无限循环，导致数千个依赖项目崩溃66% similarUnverifiedThe event-stream incident in 2020 and the node-ipc incident in 2022 both demonstrated the destructive power of software supply chain poisoning.65% similarUnverified2021年发生 PyPI 投毒事件，2022年发生多起 npm 恶意包事件，造成真实损失63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/997348API
curl https://kongchang.com/api/v1/knowledge/claims/997348MCP
get_claim(id=997348)