A while back, the node event-stream package was compromised when the author passed ownership to a hacker. Not for money afaik: https://gist.github.com/dominictarr/9fd9c1024c94592bc7268d36...