How to deal with the event-stream vulnerability

Over the past few days you've probably seen a ton of news online about the npm event-stream package vulnerability and how that package steals bitcoins. It was frustrating having to read through pile after pile of articles before finding an answer to these questions:

• Does it affect my projects?
• What do I need to do?

So I decided to put together what I researched today, in as short a summary as possible, to help you detect and fix the issue in your projects.

• based on available information, the only target package affected by the event-stream vulnerability is copay-dash. If you don't use copay-dash, relax and keep reading;
• event-stream@3.3.6 had a vulnerability in its flatmap-stream@0.1.1 dependency;
• the vulnerable version of that package has already been removed from the npm registry;
• since it was removed from the npm registry, you'll now get an error when running npm install (a clean install, no cache) and npm audit;

or

• if you see that error, your project includes the vulnerable package;
• many popular packages were affected, for example nodemon;
• search your yarn.lock or package-lock.json for the root package that installs flatmap-stream@0.1.1;
• visit the GitHub pages of the affected packages; there may already be a new version with the fix. If so, just install it with a command like npm install nodemon@latest -D;
• to learn more about what happened, read this article