Version 3.3.6 of event-stream was compromised (cryptocurrency wallet stealer). Other versions are not flagged as malicious.
Do not install event-stream 3.3.6
CRITICALanalyst verified
Cryptocurrency wallet stealer, part of the Event-Stream Cryptocurrency Theft 2018 campaign. Added to CyberXYZ 2018-11-26, verified by a CyberXYZ analyst.
// what we observed
New maintainer right9ctrl injected flatmap-stream@0.1.1 to steal Copay Bitcoin wallet credentials. One of the most impactful npm supply chain attacks.
target
Copay Bitcoin wallet
attack vector
dependency_injection
compromised account
right9ctrl
malicious dependency
flatmap-stream@0.1.1
// versions and what to do
Malicious
3.3.6
Move to
3.3.5 newest 3.x release, no known advisory
4.0.1 current release, no known advisory
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
9.8
critical
CVSS v3.1 base score out of 10
epss
not scored
chance of exploitation in 30 days
xyz score
5.1
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-mh6f-8j2x-4483, the advisory selected below
// 1 advisories
GHSA-mh6f-8j2x-4483
CRITICALGitHub rating
The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in version 3.3.6. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4, or upgrade to the latest 4.x version.
Users of flatmap-stream are encouraged to remove the dependency entirely.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Checked 2026-11-06 at 21:55 UTC. The most recent advisory here was published 2018-11-26. Updated continuously from NVD, GHSA, OSV and CNA feeds.