📦 event-stream Backdoor Targets the Copay Wallet

On 20 November 2018, it became public that flatmap-stream, added as an event-stream dependency that September, carried a backdoor aimed at BitPay's Copay wallet: it checked the balance and — "If the current balance was greater than 100 Bitcoin, or 1000 Bitcoin Cash" — harvested the private keys. Downloaded nearly 8 million times.