Executive brief
event-stream is a popular Node.js library used to process streaming data. A malicious actor injected the flatmap-stream dependency into event-stream version 3.3.6, introducing embedded malicious code designed to target cryptocurrency-related libraries like Copay. The injected code can compromise the integrity of applications and steal sensitive data from users relying on affected versions.
Technical details
This vulnerability involves CWE-506 (embedded malicious code) where a trusted npm package was compromised through repository access. The attacker added a malicious dependency (flatmap-stream) to event-stream version 3.3.6, which contained obfuscated and encrypted bytecode designed to execute selectively when specific cryptocurrency-related packages were detected in the environment. The attack is network-accessible and requires no privileges or user interaction—any installation of the affected version automatically downloads the malicious code. The payload was removed in version 4.0.0. Users are advised to downgrade to version 3.3.4 or upgrade to 4.x to remediate.
Affected products
- dominictarr event-stream 3.3.6
- flatmap-stream 0.1.1
Timeline
- 2018-11-26: disclosed
- 2018-11-26: patched: event-stream version 4.0.0 removes the malicious dependency