Blocking malicious event-stream and flatmap-stream packages

Azure DevOps has implemented blocking for malicious versions of the `flatmap-stream` (0.1.0, 0.1.1, 0.1.2) and `event-stream` (3.3.6) npm packages to prevent them from being downloaded or published to Azure DevOps feeds. This action mirrors the steps taken by the npm package manager and Visual Studio Code to mitigate the risk of these packages attempting to exfiltrate bitcoin wallets. Customers with these packages in their feeds will be contacted, and the safest approach recommended is to remain on `event-stream` version 3.3.4.