event-stream (2018): When a Maintainer Handoff Became a Supply Chain Attack

Summary

In November 2018, the widely used npm package event-stream (millions of weekly downloads at the time) was found to contain malicious code introduced through a new dependency, flatmap-stream. The payload specifically targeted the Copay bitcoin wallet application, attempting to steal wallet credentials and private keys.

Technical Root Cause

The original maintainer, no longer actively using or maintaining the package, transferred publishing rights to a volunteer who had offered to take it over. That new maintainer published a version adding flatmap-stream as a dependency, which contained an encrypted payload that only decrypted and activated under specific conditions matching the Copay build environment. The targeting was deliberately narrow, which delayed detection.

No software vulnerability was exploited. The attack succeeded entirely through legitimate package publishing by an account with legitimate permissions, obtained through social engineering of an overworked volunteer maintainer.

OWASP / CWE Mapping

• OWASP A08:2021: Software and Data Integrity Failures
• CWE-506: Embedded Malicious Code
• Related to CWE-1357 (reliance on insufficiently trustworthy component)

Why It Mattered

event-stream is a clear demonstration that a dependency's risk is not only a function of its code quality or CVE history, but of who currently controls its publishing rights, something most dependency tooling of the era did not surface at all. A package with zero known CVEs and a long clean history became an attack vector overnight through a change in human control.

Lasting Impact

The incident is a major reference point in discussions about open-source maintainer burnout as a security problem, and contributed to npm adding features around publishing controls and provenance. It foreshadowed the same pattern that appeared at larger scale in the XZ Utils backdoor six years later.

How Safeguard Helps

Safeguard's supply chain risk analysis considers signals beyond known CVEs, including dependency provenance and change patterns, since the event-stream class of attack is invisible to a scanner that only matches versions against a vulnerability database.

References

• npm advisory: https://github.com/advisories/GHSA-mh6f-8j2x-4483
• CWE-506: https://cwe.mitre.org/data/definitions/506.html