The library loading the malicious code is named Event-Stream, a JavaScript npm package for working with Node.js streaming data. This is an extremely popular JavaScript library, with over two ...

handed it over after GitHub dev “right9control” volunteered to take over the popular JavaScript library. The library Event-Stream, written in Node.js, has over 2 million downloads per week.

It runs a single-threaded event loop registered with the system to handle connections, and each new connection causes a JavaScript callback ... including popular modules such as redis, mongoose ...