NEW YORK — Nov. 26, 2018. A routine dependency in one of the npm registry's most widely used packages had, for roughly ten weeks, been quietly shipping a cryptocurrency-stealing backdoor to an estimated two million weekly downloads before anyone noticed. The package was event-stream, a utility library for working with Node.js streams. The vehicle was a second, little-known package called flatmap-stream, added as a dependency in event-stream version 3.3.6, published on September 8, 2018. The target was a single downstream application: the Copay Bitcoin and Bitcoin Cash wallet, built by BitPay, whose users the attacker hoped to quietly rob of their private keys.
By the time the malicious code was flagged — reportedly by a developer investigating unrelated build warnings, who publicly asked in a GitHub issue what flatmap-stream actually did — the tainted version had already been folded into production builds, CI pipelines, and downstream packages across the JavaScript ecosystem. The event-stream incident became one of the first widely studied cases of a maintainer-trust attack in open source: not a stolen credential, not a compromised build server, but a slow, patient social-engineering campaign that ended with a stranger being handed the keys to a package almost every Node developer had installed at least once.
A Dateline Attack: How the Takeover Happened
Dominic Tarr, the original author of event-stream, had built the package years earlier and, like many maintainers of once-popular but no-longer-actively-developed libraries, had largely stepped back from it. In late 2018, a GitHub user operating under the handle right9ctrl began engaging with the event-stream repository — opening issues, offering to help with maintenance, and submitting small, innocuous pull requests. Over a period of weeks, this pattern of unremarkable, trust-building contributions culminated in Tarr granting right9ctrl publish access to the package.
This is the part of the story that security teams should sit with: nothing about the takeover involved a vulnerability, a leaked npm token, or a phishing email. It was a governance failure — a well-intentioned maintainer, stretched thin, transferring control of a package with millions of downstream consumers to an unverified third party who had done nothing more than look helpful. It is a pattern that has recurred across the npm, PyPI, and RubyGems ecosystems many times since, but event-stream is the case that put it on the map.
The Payload: A Backdoor Built to Hide From Everyone Except One Target
Once in control, the new maintainer published event-stream 3.3.6, which quietly added a new dependency: flatmap-stream. Unlike a typical malicious package that tries to compromise as many machines as possible, flatmap-stream's payload was engineered for precision. Its core logic was encrypted, and the decryption key was derived from data specific to the application it was bundled into — meaning the malicious code would only decrypt and execute inside one particular environment: the Copay wallet's application bundle.
This targeting served two purposes for the attacker. First, it meant the payload sat dormant and functionally inert in the overwhelming majority of the roughly two million weekly installs of event-stream, making it far less likely to trip antivirus heuristics, sandboxed malware analysis, or curious developers poking at the code in a generic Node.js project. Second, it meant the attack was aimed squarely at extracting Bitcoin and Bitcoin Cash wallet credentials and private keys from Copay users — particularly those with substantial balances — and exfiltrating them to a remote server controlled by the attacker.
It was, in effect, a supply chain attack with a scalpel rather than a shotgun: broad distribution through a trusted, high-download package, narrow and deliberate detonation against one high-value downstream application.
Why the Backdoor Went Undetected for Weeks
Three structural weaknesses let flatmap-stream persist undiscovered for nearly ten weeks:
- Transitive dependency blindness. Most teams consuming event-stream were not reviewing its dependency tree line by line. flatmap-stream was a second-order dependency — a dependency of a dependency — precisely the layer of the software supply chain that traditional manual code review almost never reaches.
- Obfuscation tuned to context. Because the malicious logic only decrypted in the presence of the Copay bundle's specific application data, static analysis and generic malware scanning saw nothing but inert, encrypted-looking bytes in every other consuming project.
- Implicit trust in maintainer reputation. event-stream had years of history, a real maintainer, and a legitimate-looking commit history. Package registries at the time offered almost no signal to distinguish a trusted long-term maintainer from a recently added collaborator who had simply been granted the same publish rights.
Once discovered, the response was swift: npm removed the malicious flatmap-stream package and unpublished the compromised event-stream release, BitPay pushed a patched Copay build and issued user guidance, and Tarr published a public account of how the handoff had occurred. But the exposure window — roughly September 8 to November 20, 2018 — was long enough that the incident became a lasting reference point in supply chain security research, cited in analyses by npm's own security team and academic studies of open-source ecosystem attacks in the years that followed.
The Broader Fallout
The event-stream incident did more than compromise a single wallet application. It forced a reckoning across the JavaScript ecosystem about three things that remain central to software supply chain security conversations today:
- Maintainer succession is an attack surface. Any project with a single maintainer who can grant publish rights to a stranger is one social-engineering campaign away from a compromise, regardless of how clean its code has always been.
- Transitive dependencies carry the same risk as direct ones — often more. Security review processes that stop at a project's declared, top-level dependencies miss the layer where attackers increasingly prefer to hide.
- Download counts are not a trust signal. A package with millions of weekly downloads is not inherently safer than an obscure one; it is simply a more valuable target, and its popularity can lull consumers into skipping scrutiny they would apply to something less familiar.
npm subsequently invested in package provenance signals, and the broader ecosystem has since moved toward practices like signed commits, two-factor publish requirements, and automated dependency-tree scanning — many of which trace their urgency directly back to this incident.
How Safeguard Helps
The event-stream/flatmap-stream case is exactly the scenario Safeguard is built to catch before it reaches production. Our platform continuously ingests and generates Software Bills of Materials (SBOMs) across an organization's full dependency graph — including transitive dependencies like flatmap-stream — so security teams have visibility into packages that never appear in a top-level package.json. Griffin AI, Safeguard's analysis engine, flags anomalous maintainer and publish-pattern changes on packages already in use, surfacing exactly the kind of quiet ownership handoff that preceded this attack. Our reachability analysis goes further than dependency listing alone: it determines whether a flagged package's vulnerable or suspicious code paths are actually invoked by your application logic, so teams can distinguish dormant risk from an active, exploitable threat — the same precision-targeting dynamic that made flatmap-stream so hard to catch with generic scanning. And when a compromised or vulnerable version is identified, Safeguard can generate auto-fix pull requests that pin or roll back the affected dependency automatically, cutting the response window from weeks to minutes.