This should update your packages to a safe version and you should be good to go.
Details about the event-stream incident This is an analysis of the
event-stream incident of which many of you became aware earlier this
week. npm acts immediately to address operational concerns and issues
that affect the safety of our community, but we typically perform more
thorough analysis before discussing incidents—we know you’ve been
waiting.
On the morning of November 26th, npm’s security team was notified of a
malicious package that had made its way into event-stream, a popular
npm package. After triaging the malware, npm Security responded by
removing flatmap-stream and event-stream@3.3.6 from the Registry and
taking ownership of the event-stream package to prevent further abuse.
The malicious package was version 0.1.1 of flatmap-stream. This
package was added as a direct dependency of the event-stream package
by a new maintainer on September 9, 2018, in version 3.3.6. The
event-stream package is widely used, but the malicious code targeted
developers at a company that had a very specific development
environment setup: running the payload in any other environment has no
effect. This specific targeting means that, ultimately, most
developers would not be affected even if they had mistakenly installed
the malicious module.
The injected code targets the Copay application. When a developer at
Copay runs one of their release build scripts, the resulting code is
modified before being bundled into the application. The code was
designed to harvest account details and private keys from accounts
having a balance of more than 100 Bitcoin or 1000 Bitcoin Cash.
Copay’s initial response was that that no builds containing this
malicious code were released to the public, but we now have
confirmation from Copay that “the malicious code was deployed on
versions 5.0.2 through 5.1.0.”
The attack This attack started out as a social engineering attack. The
attacker, posing as a maintainer, took over maintainership of the
event-stream module.
The technical details Here are some technical details that we know
about, for those of you interested in this.
The injected code:
Read in AES encrypted data from a file disguised as a test fixture
Grabbed the npm package description of the module that imported it,
using an automatically set environment variable Used the package
description as a key to decrypt a chunk of data pulled in from the
disguised file The decrypted data was part of a module, which was then
compiled in memory and executed.
This module performed the following actions:
Decrypted another chunk of data from the disguised file Concatenated a
small, commented prefix from the first decrypted chunk to the end of
the second decrypted chunk Performed minor decoding tasks to transform
the concatenated block of code from invalid JS to valid JS (we believe
this was done to evade detection by dynamic analysis tools) Wrote this
processed block of JS out to a file stored in a dependency that would
be packaged by the build scripts: The chunk of code that was written
out was the actual malicious code, intended to be run on devices owned
by the end users of Copay.
This code would do the following:
Detect the current environment: Mobile/Cordova/Electron Check the
Bitcoin and Bitcoin Cash balances on the victim’s copay account If the
current balance was greater than 100 Bitcoin, or 1000 Bitcoin Cash:
Harvest the victim’s account data in full Harvest the victim’s copay
private keys Send the victim’s account data/private keys off to a
collection service running on 111.90.151.134. For users of the Copay
app, bitpay recommends, “If you are using any version from 5.0.2 to
5.1.0, you should not run or open the Copay app.”
For npm users, you can check if your project contains the vulnerable
dependency by running npm audit. If you have installed the impacted
version of this event-stream, we recommend that you update to a later
version as soon as possible.
