package removed from npm

[borisdayma]

It seems the package cannot be installed anymore from npm.

When running npm view flatmap-stream versions --json, I get:

{
  "error": {
    "code": "E404",
    "summary": "Unpublished by npm-support on 2018-11-26T17:18:17.658Z",
    "detail": "\n 'flatmap-stream' is not in the npm registry.\nYou should bug the author to publish it (or use the name yourself!)\n\nNote that you can also install from a\ntarball, folder, http url, or git url."
  }
}

[andersonsantos]

Yes! This isn't a safe package! You can check it here:
dominictarr/event-stream#116

[borisdayma]

Thanks, I got the issue when installing @vue/cli.
An issue has now been filed directly on that package: vuejs/vue-cli#3013

[leif]

see https://github.com/bitpay/copay/issues/9346 and dominictarr/event-stream#116 for information about why this was removed

[tangxiangmin]

use npm ls event-stream flatmap-stream to check if the package is installed.

[earthday]

I met this issue when using jest-puppeteer

-- jest-puppeteer@3.5.1
  `-- jest-environment-puppeteer@3.5.1
    `-- jest-dev-server@3.5.1
      `-- terminate@2.1.0
        `-- ps-tree@1.1.0
          `-- event-stream@3.3.6
            `-- flatmap-stream@0.1.2

[igibek]

where I can find flatmap-stream@0.1.1? I know that it is malicious. I need it to reverse engineer.

[vladkras]

@igibek https://unpkg.com/flatmap-stream@0.1.1/index.min.js

[Art4]

@igibek

https://unpkg.com/flatmap-stream@0.1.1/index.min.js
https://unpkg.com/flatmap-stream@0.1.1/perf-test.js
https://unpkg.com/flatmap-stream@0.1.1/test/data.js

[BennyAlex]

What is the malicious Code exactly? Coulnt find anything... Just out of interest

[EvanDarwin]

@BennyAlex It's incredibly well obfuscated. It's the entire index.min.js file.

[naiieandrade]

Hey, do you know another package similar to flatmap-stream? Because we are using in a project.

[ktvo68]

FYI, my Sophos software caught and removed this trojan when I tried to run my nodejs/express app locally. Phew!!!

[kiwenlau]

@Art4 data.js is not found

[Art4]

The code was removed. You can read everything about this malware in this blogpost
https://schneid.io/blog/event-stream-vulnerability-explained/

[artemv]

FYI, my Sophos software caught and removed this trojan when I tried to run my nodejs/express app locally. Phew!!!

@ktvo68 that was good job for Sophos considering that your app was probably not a copay/copay-dash fork with the same package description. Wonder when did the Sophos catch happen?

[EvanDarwin]

@artemv The index.min.js file's hash is flagged as known malware, most (good) AVs should now block it.