@cyberhub/trust-event-stream 1.0.62 → 1.0.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +22 -18
  2. package/package.json +3 -2
package/README.md CHANGED
@@ -1,12 +1,12 @@
1
1
  # Security Trust Report: event-stream
2
2
 
3
- **event-stream@4.0.1: 54/100 | Grade: C | Tier: STANDARD** (confidence: ±3)
3
+ **[event-stream@4.0.1](https://www.npmjs.com/package/event-stream): 53/100 | Grade: C | Tier: STANDARD** (confidence: ±3)
4
4
 
5
- > Data verified on 2026-04-02 from 8 security databases.
5
+ > Scanned on 2026-04-03 from 8 security databases. [View package on npm →](https://www.npmjs.com/package/event-stream)
6
6
 
7
7
  ## TL;DR
8
8
 
9
- - **Security incident detected** — compromised via account takeover/sabotage
9
+ - **1 vulnerability found** (1 critical, 0 high)
10
10
  - Consider switching to **highland** (High-level streams library)
11
11
  - Pin your version and monitor for changes
12
12
 
@@ -20,25 +20,29 @@ In November 2018, a malicious contributor (@right9ctrl) gained maintainer access
20
20
  Maintainer Trust: █████████░░░░░░░░░░░ 44/100
21
21
  Package Health: █████████████████░░░ 86/100
22
22
  Supply Chain: ████████░░░░░░░░░░░░ 39/100
23
- Community: █████████░░░░░░░░░░░ 46/100
23
+ Community: ████████░░░░░░░░░░░░ 41/100
24
24
  ```
25
25
 
26
26
  ### Why this score?
27
27
 
28
28
  - Maintainer Trust is 44 because: single maintainer (bus factor risk), maintainer changes detected
29
- - Supply Chain is 39 because: 1 security incident(s) in breach database, in breach database
30
- - Community is 46 because: no public GitHub repo linked (may be private or on another platform)
29
+ - Supply Chain is 39 because: 1 known CVEs, in breach database
30
+ - Community is 41 because: GitHub repo inactive
31
31
 
32
- ## ⚠️ Security Incident
32
+ ## Vulnerabilities (1 vulnerability)
33
33
 
34
- This package was compromised via account takeover/sabotage (no CVE assigned). See Security Incident Background above for details.
34
+ | Severity | Count |
35
+ |----------|-------|
36
+ | 🔴 Critical | 1 |
37
+
38
+ - [GHSA-mh6f-8j2x-4483](https://github.com/advisories/GHSA-mh6f-8j2x-4483)
35
39
 
36
40
  ## Key Risk Flags
37
41
 
38
42
  - 🔴 **CRITICAL**: HISTORICAL BREACH: Malicious code injected via flatmap-stream (2018)
39
- - 🔴 **CRITICAL**: 1 CRITICAL security incident from breach database (no CVE assigned)
43
+ - 🔴 **CRITICAL**: 1 CRITICAL vulnerability from live CVE databases
40
44
  - 🟠 **HIGH**: Primary maintainer account is less than 6 months old (0 days)
41
- - 🟠 **HIGH**: Maintainer(s) removed in v4.0.0: dominictarr
45
+ - 🟠 **HIGH**: Maintainer(s) removed in v4.0.0: dominictarr ([evidence](https://www.npmjs.com/package/event-stream/v/4.0.0))
42
46
  - 🟠 **HIGH**: Burst publishing detected — 5+ versions in a single day
43
47
 
44
48
  ## 🛠️ What Should You Do?
@@ -52,15 +56,15 @@ This package was compromised via account takeover/sabotage (no CVE assigned). Se
52
56
 
53
57
  ## 🔄 Safer Alternatives
54
58
 
55
- | Package | Why | Trust Report |
56
- |---------|-----|-------------|
57
- | **highland** | High-level streams library | [View score](https://nrupak.com/trust/highland) |
58
- | **Node.js streams** | Built-in, no dependency needed | [View score](https://nrupak.com/trust/Node.js%20streams) |
59
- | **through2** | Simple stream wrapper | [View score](https://nrupak.com/trust/through2) |
59
+ | Package | Why | npm | Trust Score |
60
+ |---------|-----|-----|-------------|
61
+ | **highland** | High-level streams library | [npm](https://www.npmjs.com/package/highland) | [View score](https://nrupak.com/trust/highland) |
62
+ | **Node.js streams** | Built-in, no dependency needed | [npm](https://www.npmjs.com/package/Node.js%20streams) | [View score](https://nrupak.com/trust/Node.js%20streams) |
63
+ | **through2** | Simple stream wrapper | [npm](https://www.npmjs.com/package/through2) | [View score](https://nrupak.com/trust/through2) |
60
64
 
61
- ## Maintainers
65
+ ## Maintainers (1)
62
66
 
63
- - [npm](https://nrupak.com/trust/maintainer/npm) ✅ 2FA (org)
67
+ - [npm](https://www.npmjs.com/~npm) ✅ 2FA (org email) — [Trust profile](https://nrupak.com/trust/maintainer/npm)
64
68
 
65
69
  **Methodology:** 18+ signals across 4 categories (Maintainer 35%, Package 25%, Supply Chain 25%, Community 15%). [Full scoring docs →](https://nrupak.com/trust)
66
70
 
@@ -71,4 +75,4 @@ This package was compromised via account takeover/sabotage (no CVE assigned). Se
71
75
 
72
76
  *Report by [pkgtrust](https://nrupak.com/trust/event-stream) · [Dashboard](https://nrupak.com/trust) · [Compare](https://nrupak.com/trust/compare) · [CLI](https://npmjs.com/package/@cyberhub/pkgtrust)*
73
77
 
74
- *This is an automated security report. Not affiliated with the event-stream team. Updated 2026-04-02.*
78
+ *This is an automated security report. Not affiliated with the event-stream team. Updated 2026-04-03.*
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@cyberhub/trust-event-stream",
3
- "version": "1.0.62",
4
- "description": "Security Trust Report: event-stream@4.0.1 — 54/100 (C, standard). Security incident detected. Maintainer risk, supply chain analysis from 8 security databases.",
3
+ "version": "1.0.63",
4
+ "description": "Security Trust Report: event-stream@4.0.1 — 53/100 (C, standard). 1 vulnerability found. Maintainer risk, supply chain analysis from 8 security databases.",
5
5
  "keywords": [
6
6
  "event-stream",
7
7
  "event-stream",
@@ -17,6 +17,7 @@
17
17
  "scan",
18
18
  "risk",
19
19
  "risk-assessment",
20
+ "GHSA-mh6f-8j2x-4483",
20
21
  "highland",
21
22
  "Node.js streams",
22
23
  "through2",