event-stream: How a Malicious npm Package Stole Crypto for Six Weeks

In autumn 2018, a developer browsing the source of a popular npm package noticed something odd: a dependency that had not been there before, containing what looked like encrypted code in a test file. What they had stumbled on was one of the most studied supply chain attacks in the history of npm.

TL;DR

event-stream was a popular Node.js utility with ~2 million weekly downloads
The original author transferred ownership to a stranger who offered to maintain it
The new maintainer added a dependency containing an encrypted payload targeting a specific bitcoin wallet
If the Copay wallet app was present, the code attempted to steal private keys and transmit them to an attacker's server
It ran undetected for six weeks before being discovered in November 2018

The transfer

event-stream was a utility that made it easier to work with data streams in Node.js. Its author, Dominic Tarr, had largely moved on. When a stranger offered to take over maintenance, he agreed — it seemed like a good outcome for a package he no longer used but that had millions of weekly downloads.

The new maintainer made one legitimate improvement to event-stream, then added a new dependency: flatmap-stream. This new package contained an encrypted payload hidden in a test file. To anyone glancing at the code, it looked unremarkable.

The payload

The encrypted code was designed to activate only under specific conditions. It would attempt to decrypt itself using a key derived from a configuration file belonging to Copay, a bitcoin wallet application made by BitPay. If Copay was present, the payload would hook into the transaction-signing process and attempt to steal private keys and wallet seed phrases — the master secrets that give full control over a wallet. These would be transmitted to an external server.

The surgical targeting is what made this attack so hard to detect. Because the payload was dormant unless Copay was installed, it was invisible to most security scanning. Two million projects installed the compromised package — but almost none would have triggered the malicious code.

Six weeks undetected

The compromised versions were live from September to November 2018 — about six weeks. They were downloaded millions of times. The discovery happened when a developer noticed the suspicious flatmap-stream dependency while doing unrelated work, and began asking questions in a GitHub issue. npm removed the malicious versions the same day.

What this changed

event-stream forced the industry to confront an uncomfortable truth: when a popular package changes hands, every project depending on it effectively inherits that new owner's access to its systems. There is no review process, no security check, no notification. The package updates and that is that.

npm introduced stricter two-factor authentication requirements for high-impact packages after this incident. It helped — but it did not close the gap entirely. The fundamental dynamic remains: the trust you place in a package is really trust in every person who has ever held publish access to it.

Tracking your exact dependency versions and getting alerted when a package adds unexpected new dependencies — or changes maintainer — is the earliest signal you can get before an attack like this reaches your build.