Attacker social-engineered maintainer Dominic Tarr into handing over publishing rights to event-stream (~2M weekly downloads). A malicious dependency (flatmap-stream) was injected targeting BitPay's Copay Bitcoin wallet to steal private keys from accounts holding over 100 BTC. The malicious version was downloaded approximately 8 million times over 2.5 months before discovery.
Sources: Dominic Tarr statement · BitPay advisory · npm postmortem
SOURCE_SINGLE_CONTRIBUTOR flagged maintainer transfer months before; PACKAGE_INSTALL_SCRIPTS caught postinstall payload
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Caught | SOURCE_SINGLE_CONTRIBUTOR flagged maintainer transfer months before; PACKAGE_INSTALL_SCRIPTS caught postinstall payload |
| Sonatype (Nexus) | Partial | Firewall may block if signature added; missed social engineering precondition |
| Socket | Caught | Behavioral analysis detects malicious flatmap-stream payload |
| Snyk | Missed | No malware detection; CVE-only |
| Black Duck | Missed | No malware detection capability |
| Endor Labs | Missed | No malware detection capability |