Poisoned Pipeline / Incidents / AS9
npm event-stream / flatmap-stream
The popular npm package event-stream, with millions of weekly downloads,
was handed by its original maintainer to a new owner who introduced a
dependency, flatmap-stream, that targeted Copay wallets and attempted to
steal Bitcoin. This is the textbook "abandoned package + unvetted
maintainer transfer" npm incident and predates most of the original technique set
attack stories.
Mapped techniques
- T0113 Compromised user account
- T0109 Publish malicious artifact
- T0111 Malicious code contribution to an open-source repository
- T0159 Malicious artifact execution
- T0139 Resource hijacking
supply-chain event-stream maintainer transfer
Ownership transferred to an attacker-controlled npm account after
the original maintainer accepted help.
flatmap-stream was published to npm as a new dependency of event-stream.
The malicious dependency was introduced via a pull/version bump that
looked like ordinary maintenance.
post-supply-chain Copay / downstream npm users
The payload decrypted and ran only in specific downstream applications.
The objective was theft of Bitcoin from Copay wallets, not a general
backdoor.
Framework gaps noted
- Package-ownership transfer without out-of-band verification is a process gap; This catalogue still has no dedicated "registry account takeover / handover" technique beyond T0113.