Key facts
Each fact is linked to the source that supports it.- The attacker gained maintainership through social engineering, then added flatmap-stream 0.1.1 as a dependency. npm / GitHub
- npm removed flatmap-stream and [email protected] from the registry and took ownership of event-stream. npm / GitHub
- Copay versions 5.0.2 through 5.1.0 were the affected application builds. npm / GitHub
Summary
A malicious dependency harvested wallet credentials in a targeted Bitcoin wallet build. The package was widely depended on, so the distribution footprint was much larger than the set of intended victims.
Component: event-stream / flatmap-stream. Disclosed: 26 November 2018. Last verified: 22 October 2026, 16:45 UTC.
Affected versions
| Product | Affected range | Note |
|---|---|---|
| event-stream | 3.3.6 | Depended on flatmap-stream 0.1.1. |
| flatmap-stream | 0.1.1 | Contained the malicious code; removed from the registry. |
| Copay | 5.0.2 through 5.1.0 | The intended target according to npm's postmortem. |
Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. npm / GitHub
Fixed versions
| Product | Fixed version | Note |
|---|---|---|
| event-stream | Registry removal / later versions | npm removed flatmap-stream and [email protected] and took ownership of event-stream. Treat any old lockfile reference as requiring review. |
The malicious package and version were removed. Installed copies and lockfiles may still reference them; removal from the registry does not clean a local cache or a built image. npm / GitHub
Conditions and scope
These are the conditions named by the sources. They are not a score and not a prediction.
- A project installed event-stream 3.3.6 or a transitive dependency that resolved to it.
- The malicious code only decrypted and ran in the targeted Copay build environment, according to npm.
- A present package does not prove the payload activated.
Exploitation status
The payload was distributed through the npm registry. npm's postmortem says it only activated in Copay's build environment; it was not a generic compromise of every dependent project.
This incident has no CVE and is not in KEV. KEV is not a supply-chain incident catalog.
Catalog version 2026.10.21 · checked 22 October 2026, 16:53 UTC .
Severity and scoring
Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.
What happened
The original event-stream maintainer handed publish rights to a contributor. That contributor added a new dependency, flatmap-stream, and version 0.1.1 of that package contained hidden code. The visible GitHub source did not match the published npm artefact, so reviewing the repository alone did not reveal it.
The payload decrypted itself only in Copay's build environment and looked for high-value wallets. npm's postmortem says running it in any other environment had no effect. That targeting limited activation but did not limit the number of projects that carried the dependency.
Lessons
A lockfile is an inventory, not a trust decision. Registry artefacts, maintainer changes and transitive dependencies are part of the supply chain. Reproducible installs and dependency review reduce the window, but they do not prove a package is benign.
This incident has no CVE and no CVSS score. Inventing one would make the record look more precise than the sources allow. The entry is included because the npm ecosystem is part of the site's scope.
What to do
- Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
- Interim controls and their limits — how to buy time without claiming a fix.
- Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.
Sources
Sources for this record
- Full text read
- Metadata only
Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.