A widely used third-party NodeJS module with nearly 2 million downloads a week was compromised after one of its open-source contributor gone rogue, who infected it with a malicious code that was programmed to steal funds stored in Bitcoin wallet apps.
The Node.js library in question is “Event-Stream,” a toolkit that makes it easy for developers to create and work with streams, a collection of