CriticalGHSA-mh6f-8j2x-4483
Critical severity vulnerability that affects event-stream and flatmap-stream
Published 26 Nov 2018 · Updated 15 Sept 2021
Affected packages
event-streamnpm
- Affected
- >=3.3.6 <4.0.0
- Fixed in
- 4.0.0
Update to the fixed version for your release line, for example:
npm install event-stream@4.0.0- Affected
- All versions
- Fixed in
- No fix released
Details
The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in version 3.3.6. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4, or upgrade to the latest 4.x version.
Users of flatmap-stream are encouraged to remove the dependency entirely.
Is GHSA-mh6f-8j2x-4483 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected event-stream, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.