Microsoft

Blocking malicious versions of event-stream and flatmap-stream packages

Nov 29, 2018Buck Hodges
Blocking malicious versions of event-stream and flatmap-stream packages
SummaryAI, from the source post

Azure DevOps has implemented blocking for specific malicious versions of the `event-stream` and `flatmap-stream` npm packages to prevent them from being downloaded or published to Azure DevOps feeds. This action is in response to a security advisory identifying harmful code in these packages that attempted to exfiltrate bitcoin wallet information. The blocked versions are `flatmap-stream` versions 0.1.0, 0.1.1, and 0.1.2, and `event-stream` version 3.3.6. Customers with these packages in their feeds will be contacted.

More from the Azure Artifacts Rust Crate Support trail