--- title: "Backdoor found in commonly used npm package" publication: "Node Weekly" issue: 265 published_at: "2018-11-29" canonical_url: "https://nodeweekly.com/issues/265" --- The latest Node.js news, articles, tools, and projects. #265 — November 29, 2018 [Read on the Web](https://nodeweekly.com/issues/265) Node Weekly Backdoor Found in Heavily Used npm Package The biggest Node news this week is that an npm package with almost 2 million downloads _every week_ ([event-stream](https://github.com/dominictarr/event-stream)) was the target of an attack ([original report here](https://github.com/dominictarr/event-stream/issues/116)) which meant developers under limited circumstances (users of [copay](https://github.com/bitpay/copay) and related libraries) were vulnerable to a security issue aimed at capturing cryptocurrency info. Relatively few Node developers or apps are affected by the issue _directly_, but it's provoked much discussion in the community around the stewardship and transfer of modules, so we're linking to some of the key articles today. [The `event-stream` Vulnerability Explained](https://schneid.io/blog/event-stream-vulnerability-explained/) — A good writeup of what the attack entailed and how it technically worked behind the scenes. Zach Schneider [event-stream's Creator's Statement](https://gist.github.com/dominictarr/9fd9c1024c94592bc7268d36b8d83b3a) — Dominic originally created event-stream for his own benefit and had no reason to doubt the malicious developer who offered to take over maintenance of the library. Here he tells his side of the story and suggests things we need to think about as a community to help in future. Dominic Tarr [![\](https://copm.s3.amazonaws.com/8a446b41.jpg)](https://frontendmasters.com/courses/node-js/) [New Course: Introduction to Node.js by Scott Moss ✨ 👀](https://frontendmasters.com/courses/node-js/) — Node.js can be used for build tools, desktop apps, mobile apps, databases, and more. Learn the foundations of Node.js so you can go forward and create fantastic JavaScript apps outside the browser. Frontend Masters sponsor [Node.js November 2018 Security Releases](https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/) — All active Node release lines have got new releases due to a variety of vulnerabilities from DDoS issues to a Node 6.x vulnerability where the debugger listens on all interfaces by default. The releases are [11.3.0](https://nodejs.org/en/blog/release/v11.3.0/), [10.14.0](https://nodejs.org/en/blog/release/v10.14.0/), [8.14.0](https://nodejs.org/en/blog/release/v8.14.0/) and [6.15.0](https://nodejs.org/en/blog/release/v6.15.0/). Node.js Foundation [ncc: The Node.js Compiler Collection](https://zeit.co/blog/ncc) — Inspired by native compiler toolchains, `ncc` can output a self-contained script (not an executable, like [pkg](https://github.com/zeit/pkg) does) that bundles all its dependencies. ZEIT [Details About the event-stream Incident from npm, Inc.](https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident) — As owners of the registry through which npm packages are distributed, npm Inc. has something to say on the event-stream incident (featured above) and recommends you run `npm audit` to check if your projects use the affected module. npm Inc. 💻 Jobs [Sr. Fullstack Engineer (Remote)](https://www.stickermule.com/careers) — Sticker Mule is looking for passionate developers to join our remote team. Come help us become the Internet’s best place to shop and work. Sticker Mule [100+ Node.js and JavaScript Roles on hackajob](https://hackajob.co/p/discover?utm_source=cooperpress&utm_medium=paid&utm_campaign=node_nov_w4&utm_term=nodejs) — Upload your projects from GitHub and we'll do the rest. Find a role based on your skills, average salary £70k. hackajob 📘 Tutorials & Opinions [Transpiling and Publishing ES2018 npm Modules with Babel 7](https://blog.vanmulligen.ca/2018/transpiling-es9-node-modules-with-babel-7/) — How to use the latest and greatest JavaScript features but still ensure your packages can be used by as wide an audience as possible. Sean van Mulligen [Testing HTTP Requests in Node Using Nock](https://alligator.io/nodejs/testing-http-requests-with-nock/) — nock, or “network mock”, is a library for mocking HTTP server requests. Josh Sherman [Automating Excel File Generation using ExcelJS](https://spin.atomicobject.com/2018/11/28/nodejs-excel-file-generation/) — How to easily generate Microsoft Excel workbooks/spreadsheets using the [ExcelJS](https://github.com/guyonroche/exceljs) module. Jordan Nelson [Writing Memory Efficient Software Applications in Node](https://medium.com/dev-bits/writing-memory-efficient-software-applications-in-node-js-5575f646b67f) — See how to optimize your Node.js programs by 90% using automatic back pressuring. Naren Yellavula [Testing Your API with Dredd](https://medium.com/mop-developers/testing-your-api-with-dredd-c02e6ca151f2) — [Dredd](https://dredd.readthedocs.io/en/latest/) is a language-agnostic command-line tool for validating a description of an API against the backend implementation. Milhad Salihi [Using Custom Images to Bring Your Linux Disk Images to DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-create-an-image-of-your-linux-environment-and-launch-it-on-digitalocean?utm_medium=display&utm_source=cooperpress&utm_campaign=2018_Brand_Businesses100&utm_content=node+weekly+11-29) DigitalOcean sponsor ▶[The Art of Building Node.js Projects at Scale](https://www.youtube.com/watch?v=_H6td2GaW3I) — An IBM engineer tells the tale of building LoopBack 4 using Node and TypeScript. Raymond Feng (IBM) [Why You Should Isolate Express from the Rest of Your App](https://www.coreycleary.me/why-you-should-isolate-express-from-the-rest-of-your-node-application/) — Loosely coupling your app logic from the Web side of things could help you with testing, structure, and more. Corey Cleary 🔧 Code and Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/ludkke2lfptzhymypqt8.jpg)](https://github.com/bvaughn/progress-estimator) [progress-estimator: A Progress Bar and Time Estimate for Promises](https://github.com/bvaughn/progress-estimator) — It tracks previous durations between responses in order to provide more accurate completion time estimates over time. Brian Vaughn [nodenv: Manage Multiple Node Versions Easily](https://github.com/nodenv/nodenv) — Specify your app’s Node version once in a single file and it all Just Works™. Will McKenzie and Sam Stephenson [N|Solid for AWS Lambda: Low-Impact Monitoring for Serverless Node.js Apps](https://pages.nodesource.com/lambda-platform-signup-nw.html) — The N|Solid runtime is now available for serverless Node.js apps on AWS Lambda. NodeSource sponsor [create-yo: Use Any Yeoman Generator with `npm init`](https://boneskull.com/create-yo/) Christopher Hiller [whitebophir: A Web-Based Collaborative Whiteboard](https://github.com/lovasoa/whitebophir) — There’s an open [public demo](https://wbo.openode.io/boards/anonymous) (be warned, people may draw offensive stuff on there). Ophir Lojkine [yamlful: YAML-Based HTTP Client Code Generation](https://github.com/galvez/yamlful) Jonas Galvez Curated by [Cooperpress](https://cooperpress.com/) and [Peter Cooper](https://twitter.com/peterc) [Change your email address](https://nodeweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://nodeweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom