Case study: event-stream and ua-parser-js, two npm package takeovers

Popular packages are maintained by people, and an attacker who controls what those people publish controls what millions of installs receive. These two incidents show the two common routes. In event-stream the attacker was given control: the original maintainer, who no longer used the package, handed publishing rights to a volunteer who asked for them. In ua-parser-js the attacker took control: the maintainer's npm account was hijacked and used to publish malicious versions.

Neither package was something most victims had chosen. event-stream was a dependency of other tools, and ua-parser-js sat deep in the dependency trees of front-end and Node.js projects. Version ranges and transitive dependencies delivered the malicious versions automatically.

The maintainer explained on the issue that he no longer used the module and got nothing from maintaining it, so when someone emailed to offer help he gave it to them. The new maintainer published event-stream 3.3.6 with flatmap-stream as a new dependency, then released 4.0.0 without it, which made the repository look clean while every project on a 3.x range kept installing 3.3.6.

The malicious code was in flatmap-stream 0.1.1, and only in its minified file, which few people read; the readable source on GitHub did not contain it. It carried AES-encrypted data disguised as a test fixture and used the description of the package that imported it as the key. The data decrypted only inside the Copay Bitcoin wallet's build, where it tried to harvest account data and private keys from wallets holding more than 100 Bitcoin or 1,000 Bitcoin Cash. Everywhere else it did nothing visible, which is why it ran unnoticed for weeks.

On 2021-10-22 the maintainer of ua-parser-js, a widely used user-agent parser, noticed his email being flooded with spam from hundreds of websites, which he took as an attempt to hide notifications. Someone had hijacked his npm account and published 0.7.29, 0.8.0 and 1.0.0. Analysis posted on the issue showed the payload ran from a preinstall script and downloaded binaries on Windows and Linux; commenters reported attempts to steal saved passwords and cookies, and GitHub's advisory told anyone who installed it to treat the computer as fully compromised.

He reported it to npm, deprecated the versions and, after advice on the issue, published 0.7.30, 0.8.1 and 1.0.1 so that ranges would resolve past the bad releases. The malicious versions were the latest for about four hours. Two weeks later the coa and rc packages were hijacked in the same way. All three were account takeovers, not code changes in the projects' repositories, which is why repository review alone could not catch them.

• Transitive dependencies: victims installed tools that depended on these packages, often several levels deep.
• Version ranges: ^3.3.0 resolved to event-stream 3.3.6, and ^0.7.0 to ua-parser-js 0.7.29, in any install that was not locked.
• Install scripts: npm ran dependencies' preinstall scripts by default, so ua-parser-js's payload ran during npm install, before any code imported it.
• No delay: a new version was installable the moment it was published, so the four-hour window was enough.
• Weak publishing controls: a stolen password or token was enough to publish, and a handover needed only the old maintainer's agreement.
• Unreadable artifacts: the event-stream payload sat in a minified file that differed from the published source.

Lockfiles record exactly what was installed, so they answer the exposure question for any build that used them. The script below walks npm lockfiles in formats 1, 2 and 3 and reports every copy of the malicious versions with its install path. A hit in a lockfile used in CI or on a developer machine during the window means the code ran there, for ua-parser-js at install time.

"""Report malicious package versions from the event-stream, ua-parser-js, coa and rc incidents
in npm lockfiles (lockfileVersion 1, 2 or 3). Usage: python3 find_bad_versions.py */package-lock.json
"""
import json
import sys

BAD = {
    "event-stream": {"3.3.6"},
    "flatmap-stream": {"0.1.1"},
    "ua-parser-js": {"0.7.29", "0.8.0", "1.0.0"},
    "coa": {"2.0.3", "2.0.4", "2.1.1", "2.1.3", "3.0.1", "3.1.3"},
    "rc": {"1.2.9", "1.3.9", "2.3.9"},
}


def entries(lock):
    """Yield (install path, name, version) for every package in the lockfile."""
    for path, meta in lock.get("packages", {}).items():  # lockfileVersion 2 and 3
        if path:
            yield path, meta.get("name") or path.rsplit("node_modules/", 1)[-1], meta.get("version")
    stack = [("", lock.get("dependencies", {}))]          # lockfileVersion 1
    while stack:
        prefix, deps = stack.pop()
        for name, meta in deps.items():
            yield f"{prefix}{name}", name, meta.get("version")
            stack.append((f"{prefix}{name} > ", meta.get("dependencies", {})))


found = False
for file in sys.argv[1:]:
    with open(file, encoding="utf-8") as f:
        lock = json.load(f)
    for path, name, version in sorted(set(entries(lock))):
        if version in BAD.get(name, ()):
            found = True
            print(f"{file}: {name}@{version} at {path}")
sys.exit(1 if found else 0)

Three consumer settings would have blocked or contained both incidents: install from a lockfile, turn dependency install scripts off by default, and refuse versions only hours old. npm 12 blocks dependency install scripts unless allowScripts approves them, and pnpm has not run them by default since version 10. For maintainers, trusted publishing from CI with provenance and 2FA for interactive publishes means a stolen password or token cannot publish on its own; /domains/supply-chain/releases/trusted-publishing-and-updates/ covers the setup.

# ~/.npmrc or the project's .npmrc (npm 11.10+)
ignore-scripts=true    # no preinstall/postinstall from dependencies (npm 12 blocks them by default)
min-release-age=3      # skip versions published in the last 3 days

# CI: install exactly the lockfile, never re-resolve ranges
npm ci

# What is installed, and through which parent?
npm ls event-stream flatmap-stream ua-parser-js --all

# Maintainers: publish from CI with trusted publishing, and require 2FA
# for any interactive publish, so a stolen password or token is not enough
npm access set mfa=publish <package-name>

The OpenSSF Secure Supply Chain Consumption Framework (S2C2F) uses both incidents as examples: it maps event-stream to malware scanning (SCA-4) and a curated feed (ENF-2), and ua-parser-js to provenance verification (AUD-1), ENF-2 and SCA-4, all at maturity level 3.

• Maintainer burnout is a security issue: a package with one tired maintainer can change hands with an email, as xz Utils showed again in 2024 (/domains/supply-chain/dependencies/case-study-xz-utils/).
• Install-time code is the most dangerous kind, because it runs on developer machines and CI runners before tests or review.
• Malicious versions are usually caught within hours to weeks; a short release-age delay is cheap protection.
• Compare what you install with what you reviewed: the published package, including minified files, not the GitHub repository.
• The same pattern scaled up in the self-spreading npm worms of 2025 and 2026: /domains/supply-chain/dependencies/case-study-shai-hulud/.

The identity of event-stream's new maintainer and of whoever hijacked the ua-parser-js, coa and rc accounts is not public, and no first-party source connects the incidents to each other. The exact publication date of flatmap-stream 0.1.1 is not in the npm report, and the registry no longer lists the removed versions. How the ua-parser-js account was taken over is not documented beyond the maintainer's account of the spam flood, and no public source counts the machines that actually ran either payload.

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. npm: Details about the event-stream incident (2018-11-27)
2. dominictarr/event-stream issue #116: I don't know what to say
3. GitHub Advisory GHSA-mh6f-8j2x-4483: event-stream and flatmap-stream. 26 November 2018.
4. faisalman/ua-parser-js issue #536: compromised npm packages
5. GitHub Advisory GHSA-pjwm-rvh2-c87w: Embedded malware in ua-parser-js. 22 October 2021.
6. CISA: Malware discovered in popular npm package ua-parser-js (2021-10-22)
7. GitHub Advisory GHSA-73qr-pfmq-6rp8: Embedded malware in coa. 4 November 2021.
8. GitHub Advisory GHSA-g2q5-5433-rhrf: Embedded malware in rc. 4 November 2021.
9. OpenSSF S2C2F: Secure Supply Chain Consumption Framework
10. npm Docs: config (ignore-scripts, min-release-age)
11. GitHub Changelog: npm install-time security and GAT bypass2fa deprecation. 8 July 2026.

Reference information

Tags

Account takeoverDependency managementSupply chain attacksSupplier and open source riskJavaScript and Node.js

SDLC phase

DevelopmentMaintenanceSecurity program

Role

DevelopersPlatform engineers and SREs

CAPEC attack patterns

• CAPEC-538 at MITRE

Download this guide as Markdown

Continue exploring