COMPROMISED DEPENDENCY event-stream / flatmap-stream

[TomDemulierChevret]

I'm submitting a...

[ ] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report  
[ ] Performance issue
[ ] Feature request
[ ] Documentation issue or request
[ ] Support request => https://github.com/ngxs/store/blob/master/CONTRIBUTING.md
[x] Other... Please describe: Security issue

Current behavior

Currently ngxs contains dependencies to 1 compromised npm package : flatmap-stream :

npm ls event-stream flatmap-stream
ngxs@3.3.0 C:\Users\tdemulier\WebstormProjects\ngxs
`-- npm-run-all@4.1.3
  `-- ps-tree@1.1.0
    `-- event-stream@3.3.6
      `-- flatmap-stream@0.1.1

The author of event-stream has given npm publishing right to a another user who used them to publish malicious code (via flatmap-stream).

This dependency is linked to ngxs via npm-run-all which is only a devDependency, so it shouldn't put at risk end users of the library.
But you should still get rid of it.

If you want to read more this issue :

• https://medium.com/intrinsic/compromised-npm-package-event-stream-d47d08605502
• I don't know what to say. dominictarr/event-stream#116 (comment)

Expected behavior

The dependencies should be updated to not contains a compromised package.

[splincode]

@markwhitfeld ping

[Thenis]

Updating npm-run-all to v4.1.5 will fix the issue mysticatea/npm-run-all#155

[eranshmil]

The locked version is 4.1.5, as you can see in the yarn.lock: https://github.com/ngxs/store/blob/master/yarn.lock#L5937

[splincode]

@markwhitfeld please publish new version 3.3.2

[eranshmil]

I guess that you can close this issue.