Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months | Snyk

A widely used npm package, event-stream, has been found to contain a malicious package named flatmap-stream. This was disclosed via a GitHub issue raised against the source repo. The event-stream package makes creating and working with streams easy, and is very popular, getting roughly 2 million downloads a week. The malicious child package has been downloaded nearly 8 million times since its incl

[yosuke_furukawa]

npm package の event-stream が悪意のあるメンテナーによってflatmap-streamという攻撃するライブラリを依存に仕込まれた話の顛末。

[efcl]

`event-stream@3.x`と`flatmap-stream`の問題について。 `flatmap-stream`にwalletsからbitcoinを盗むコードが含まれており、`event-stream@3.x`がこのパッケージに依存していた問題について。 現在`flatmap-stream`はnpmからunpublishされている