The library loading the malicious code is named Event-Stream, a JavaScript npm package for working with Node.js streaming data ... a desktop and mobile wallet app developed by Bitcoin payment ...

This can be avoided by loading the code from a local server or by running it in a Node.js instance. Due to JavaScript’s small standard library, a great deal of the functionality JavaScript apps ...