In November 2018, a GitHub issue reported that event-stream pulled in a malicious dependency, flatmap-stream. The maintainer wrote that someone emailed to offer to maintain the module and he handed it over. The thread is a record of how little checking a handover needed.
What the thread shows
The issue was opened on 20 November 2018. It reports a malicious payload in flatmap-stream 0.1.1, brought in by event-stream, and says users were affected only if flatmap-stream appeared in their dependency tree. It names event-stream 3.3.6 as a version that pulled it in, and recommends event-stream 3.3.4. A later edit notes npm removed the malicious version.
The issue author alleged that flatmap-stream was added by a new account, had no downloads before use and had a single commit across three versions. The thread presents those claims without verification, and several commenters said the analysis was incomplete.
The handover
The maintainer, in the thread, wrote that someone emailed offering to maintain the module and he gave it to them, that he no longer used it, and that he no longer had publish rights. Another user noted the new account appeared in the owner list.
Nothing in that account describes a hack. It describes trust extended to a stranger who asked.
The payload
According to the thread, early analysis showed the code ran only when the package description matched a specific value, which was used as a decryption key. Later comments quote a description of a secure bitcoin wallet and code aimed at wallet related data. Commenters said the decoded code read wallet data from browser storage and posted it to two hosts. The thread notes these decodings were unverified, so treat the target as reported, not proven.
What this teaches consumers
- Watch for ownership changes and new maintainers on packages you depend on. A new maintainer is a reason to read the next diff.
- Look at what a new transitive dependency does when it first appears in a lockfile diff.
- Packages with no history that suddenly appear in a popular tree deserve a look.
- Check maintainer health signals before adopting something critical.
What this teaches maintainers
If you want to step away, say so publicly, hand over to someone with a track record, transfer through the registry with a second maintainer involved, and archive the project if no one suitable exists. Writing "this package is no longer maintained" is a legitimate and safe outcome. For the other side of the same problem, see maintainer burnout signs.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an unfamiliar transitive package would show up in your list.
Quick check
How would I know if I had flatmap-stream?
Run npm ls flatmap-stream and check lockfiles. The thread posted that approach.
Was the original maintainer hacked?
The maintainer's own comment describes giving the package to someone who asked. The thread does not claim a hack.
Sources
- GitHub, event-stream issue 116, November 2018. Claims in the thread are unverified user reports.
Last reviewed: 19 October 2026.
