GitHub Advisoryadvisory · npm

GHSA-mh6f-8j2x-4483 Critical severity vulnerability that affects event-stream and flatmap-stream

CRITICAL Published 2018-11-26 Modified 2021-09-15 Official page ↗
Ecosystem
npm
Packages
event-stream, flatmap-stream
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-506
Reviewed
2020-06-16

Affected packages

• npm event-stream: >= 3.3.6, < 4.0.0 → fixed in 4.0.0 • npm flatmap-stream: all versions (no fix yet)

Description

The NPM package `flatmap-stream` is considered malicious. A malicious actor added this package as a dependency to the NPM `event-stream` package in version `3.3.6`. Users of `event-stream` are encouraged to downgrade to the last non-malicious version, `3.3.4`, or upgrade to the latest 4.x version. Users of `flatmap-stream` are encouraged to remove the dependency entirely.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References