event-stream npm Attack: The flatmap-stream Bitcoin Theft
In one of the first npm supply chain attacks to draw mainstream attention, an attacker using the handle right9ctrl approached the maintainer of the popular event-stream package, offered to help maintain it, and was granted both a contributor role and full npm publish rights. On September 9, 2018, that access was used to add a new dependency, flatmap-stream, containing an encrypted payload surgically targeted at Copay, a Bitcoin and Bitcoin Cash wallet application, designed to steal wallet private keys once a balance crossed a specific threshold. The malicious package was downloaded millions of times before it was discovered and removed on November 26, 2018.
What happened
event-stream was a small but heavily depended-upon utility package. Its original maintainer, Dominic Tarr, had stepped back from active development, which is precisely the condition right9ctrl exploited: they offered to take over maintenance, were given commit and publish access after a period of legitimate-looking contributions, and then added flatmap-stream as a new dependency in version 3.3.6. The payload inside flatmap-stream was encrypted and designed to activate only in a very specific runtime environment, one matching Copay's build setup, which let it evade casual inspection and automated scanning for weeks.
Once triggered in the correct environment, the code searched for a Bitcoin or Bitcoin Cash wallet with a balance above roughly 100 BTC or 1000 BCH and attempted to exfiltrate the private keys. Because the attack relied on a socially engineered handoff of trust rather than a stolen credential, it exposed a structural weakness that npm's security model had not yet accounted for: a legitimate-looking new maintainer with full publish rights is functionally indistinguishable from the original author until something goes wrong.
How 0Day mitigates this
Read how this differs from advisory feeds that only report what already made headlines, or see exactly what access 0Day needs to watch your dependency graph.
Sources
Snyk: A Post-Mortem of the Malicious event-stream Backdoor
npm Blog: Details About the event-stream Incident
The Register: Crypto-Coin-Stealing Code Sneaks Into Popular NPM Lib