Remove event-stream dependency -- malicious actor

[dpilafian]

event-stream
critical severity
Vulnerable versions: > 3.3.4
Patched version: No fix

The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in versions 3.3.6 and later. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4.

Check your repos... Crypto-coin-stealing code sneaks into fairly popular NPM lib:
https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/