@cyberhub/trust-event-stream 1.0.62 → 1.0.64
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +23 -19
- package/package.json +3 -2
package/README.md
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
# Security Trust Report: event-stream
|
|
2
2
|
|
|
3
|
-
**event-stream@4.0.1:
|
|
3
|
+
**[event-stream@4.0.1](https://www.npmjs.com/package/event-stream): 53/100 | Grade: C | Tier: STANDARD** (confidence: ±3)
|
|
4
4
|
|
|
5
|
-
>
|
|
5
|
+
> Scanned on 2026-04-10 from 8 security databases. [View package on npm →](https://www.npmjs.com/package/event-stream)
|
|
6
6
|
|
|
7
7
|
## TL;DR
|
|
8
8
|
|
|
9
|
-
- **
|
|
9
|
+
- **1 vulnerability found** (1 critical, 0 high)
|
|
10
10
|
- Consider switching to **highland** (High-level streams library)
|
|
11
11
|
- Pin your version and monitor for changes
|
|
12
12
|
|
|
@@ -20,25 +20,29 @@ In November 2018, a malicious contributor (@right9ctrl) gained maintainer access
|
|
|
20
20
|
Maintainer Trust: █████████░░░░░░░░░░░ 44/100
|
|
21
21
|
Package Health: █████████████████░░░ 86/100
|
|
22
22
|
Supply Chain: ████████░░░░░░░░░░░░ 39/100
|
|
23
|
-
Community:
|
|
23
|
+
Community: ████████░░░░░░░░░░░░ 41/100
|
|
24
24
|
```
|
|
25
25
|
|
|
26
26
|
### Why this score?
|
|
27
27
|
|
|
28
28
|
- Maintainer Trust is 44 because: single maintainer (bus factor risk), maintainer changes detected
|
|
29
|
-
- Supply Chain is 39 because: 1
|
|
30
|
-
- Community is
|
|
29
|
+
- Supply Chain is 39 because: 1 known CVEs, in breach database
|
|
30
|
+
- Community is 41 because: GitHub repo inactive
|
|
31
31
|
|
|
32
|
-
##
|
|
32
|
+
## Vulnerabilities (1 vulnerability)
|
|
33
33
|
|
|
34
|
-
|
|
34
|
+
| Severity | Count |
|
|
35
|
+
|----------|-------|
|
|
36
|
+
| 🔴 Critical | 1 |
|
|
37
|
+
|
|
38
|
+
- [GHSA-mh6f-8j2x-4483](https://github.com/advisories/GHSA-mh6f-8j2x-4483)
|
|
35
39
|
|
|
36
40
|
## Key Risk Flags
|
|
37
41
|
|
|
38
42
|
- 🔴 **CRITICAL**: HISTORICAL BREACH: Malicious code injected via flatmap-stream (2018)
|
|
39
|
-
- 🔴 **CRITICAL**: 1 CRITICAL
|
|
43
|
+
- 🔴 **CRITICAL**: 1 CRITICAL vulnerability from live CVE databases
|
|
40
44
|
- 🟠 **HIGH**: Primary maintainer account is less than 6 months old (0 days)
|
|
41
|
-
- 🟠 **HIGH**: Maintainer(s) removed in v4.0.0: dominictarr
|
|
45
|
+
- 🟠 **HIGH**: Maintainer(s) removed in v4.0.0: dominictarr ([evidence](https://www.npmjs.com/package/event-stream/v/4.0.0))
|
|
42
46
|
- 🟠 **HIGH**: Burst publishing detected — 5+ versions in a single day
|
|
43
47
|
|
|
44
48
|
## 🛠️ What Should You Do?
|
|
@@ -52,23 +56,23 @@ This package was compromised via account takeover/sabotage (no CVE assigned). Se
|
|
|
52
56
|
|
|
53
57
|
## 🔄 Safer Alternatives
|
|
54
58
|
|
|
55
|
-
| Package | Why | Trust
|
|
56
|
-
|
|
57
|
-
| **highland** | High-level streams library | [View score](https://nrupak.com/trust/highland) |
|
|
58
|
-
| **Node.js streams** | Built-in, no dependency needed | [View score](https://nrupak.com/trust/Node.js%20streams) |
|
|
59
|
-
| **through2** | Simple stream wrapper | [View score](https://nrupak.com/trust/through2) |
|
|
59
|
+
| Package | Why | npm | Trust Score |
|
|
60
|
+
|---------|-----|-----|-------------|
|
|
61
|
+
| **highland** | High-level streams library | [npm](https://www.npmjs.com/package/highland) | [View score](https://nrupak.com/trust/highland) |
|
|
62
|
+
| **Node.js streams** | Built-in, no dependency needed | [npm](https://www.npmjs.com/package/Node.js%20streams) | [View score](https://nrupak.com/trust/Node.js%20streams) |
|
|
63
|
+
| **through2** | Simple stream wrapper | [npm](https://www.npmjs.com/package/through2) | [View score](https://nrupak.com/trust/through2) |
|
|
60
64
|
|
|
61
|
-
## Maintainers
|
|
65
|
+
## Maintainers (1)
|
|
62
66
|
|
|
63
|
-
- [npm](https://
|
|
67
|
+
- [npm](https://www.npmjs.com/~npm) ✅ 2FA (org email) — [Trust profile](https://nrupak.com/trust/maintainer/npm)
|
|
64
68
|
|
|
65
69
|
**Methodology:** 18+ signals across 4 categories (Maintainer 35%, Package 25%, Supply Chain 25%, Community 15%). [Full scoring docs →](https://nrupak.com/trust)
|
|
66
70
|
|
|
67
71
|
**Check your project:** `npm i -g @cyberhub/pkgtrust && pkgtrust scan event-stream` — [CLI docs](https://npmjs.com/package/@cyberhub/pkgtrust)
|
|
68
|
-
**Data Sources:** GitHub Advisories · OSV.dev · npm audit · Snyk · Socket.dev · npms.io · Bundlephobia · deps.dev
|
|
72
|
+
**Data Sources:** GitHub Advisories · OSV.dev · npm audit · Snyk · Socket.dev · npms.io · Bundlephobia · deps.dev · CISA KEV · Packagephobia · OpenSSF Scorecard · Ecosyste.ms · GitHub Enhanced · Keybase · npm Provenance
|
|
69
73
|
|
|
70
74
|
---
|
|
71
75
|
|
|
72
76
|
*Report by [pkgtrust](https://nrupak.com/trust/event-stream) · [Dashboard](https://nrupak.com/trust) · [Compare](https://nrupak.com/trust/compare) · [CLI](https://npmjs.com/package/@cyberhub/pkgtrust)*
|
|
73
77
|
|
|
74
|
-
*This is an automated security report. Not affiliated with the event-stream team. Updated 2026-04-
|
|
78
|
+
*This is an automated security report. Not affiliated with the event-stream team. Updated 2026-04-10.*
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cyberhub/trust-event-stream",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"description": "Security Trust Report: event-stream@4.0.1 —
|
|
3
|
+
"version": "1.0.64",
|
|
4
|
+
"description": "Security Trust Report: event-stream@4.0.1 — 53/100 (C, standard). 1 vulnerability found. Maintainer risk, supply chain analysis from 8 security databases.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"event-stream",
|
|
7
7
|
"event-stream",
|
|
@@ -17,6 +17,7 @@
|
|
|
17
17
|
"scan",
|
|
18
18
|
"risk",
|
|
19
19
|
"risk-assessment",
|
|
20
|
+
"GHSA-mh6f-8j2x-4483",
|
|
20
21
|
"highland",
|
|
21
22
|
"Node.js streams",
|
|
22
23
|
"through2",
|