Copay wallet targeted private keys

Copay was the target hidden inside the event-stream compromise. The attacker did not need to publish a fake wallet. They took over an upstream npm maintainer path, added flatmap-stream to event-stream, and waited for Copay's build chain to carry the payload into wallet releases.

The malicious code was selective. It stayed buried in an obfuscated npm dependency and decrypted only in the Copay context. BitPay later said versions 5.0.2 through 5.1.0 of the Copay and BitPay apps contained the malicious dependency chain, but the BitPay wallet was not vulnerable to execution.

The payload tried to capture private keys and send them to attacker-controlled infrastructure. That made the downstream impact different from the broad npm ecosystem impact: most event-stream consumers carried malicious code, but Copay users carried the value the attacker wanted.

BitPay fixed Copay in 5.2.0, told users not to open affected apps, and advised moving funds to a new wallet created with the clean version rather than reusing twelve-word backup phrases from potentially compromised wallets. Later 5.3.1 work locked dependency updates and restricted wallet network connections.