event-stream npm supply-chain compromise

Summary

A malicious dependency harvested wallet credentials in a targeted Bitcoin wallet build. The package was widely depended on, so the distribution footprint was much larger than the set of intended victims.

Component: event-stream / flatmap-stream. Disclosed: 26 November 2018. Last verified: 22 October 2026, 16:45 UTC.

Affected versions

Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. npm / GitHub

Fixed versions

The malicious package and version were removed. Installed copies and lockfiles may still reference them; removal from the registry does not clean a local cache or a built image. npm / GitHub

Conditions and scope

These are the conditions named by the sources. They are not a score and not a prediction.

• A project installed event-stream 3.3.6 or a transitive dependency that resolved to it.
• The malicious code only decrypted and ran in the targeted Copay build environment, according to npm.
• A present package does not prove the payload activated.

Exploitation status

The payload was distributed through the npm registry. npm's postmortem says it only activated in Copay's build environment; it was not a generic compromise of every dependent project.

Severity and scoring

Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.

What happened

The original event-stream maintainer handed publish rights to a contributor. That contributor added a new dependency, flatmap-stream, and version 0.1.1 of that package contained hidden code. The visible GitHub source did not match the published npm artefact, so reviewing the repository alone did not reveal it.

The payload decrypted itself only in Copay's build environment and looked for high-value wallets. npm's postmortem says running it in any other environment had no effect. That targeting limited activation but did not limit the number of projects that carried the dependency.

Lessons

A lockfile is an inventory, not a trust decision. Registry artefacts, maintainer changes and transitive dependencies are part of the supply chain. Reproducible installs and dependency review reduce the window, but they do not prove a package is benign.

This incident has no CVE and no CVSS score. Inventing one would make the record look more precise than the sources allow. The entry is included because the npm ecosystem is part of the site's scope.

What to do

• Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
• Interim controls and their limits — how to buy time without claiming a fix.
• Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.

Sources

Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.