Remove event-stream dependency

[XhmikosR]

@mysticatea please check dominictarr/event-stream#116

[jaydenseric]

To know if your project is in danger, run:

npm ls event-stream flatmap-stream

The bad actor has publishing rights to event-stream and flatmap-stream contains the malicious code (specifically flatmap-stream@0.1.1, but any future version can't be trusted).

Here is an example result from one of my projects:

[redacted]
└─┬ npm-run-all@4.1.3
  └─┬ ps-tree@1.1.0
    └─┬ event-stream@3.3.6
      └── flatmap-stream@0.1.2

[mysticatea]

Wow, thank you for the pointing.

[XhmikosR]

@mysticatea Maybe try replacing the unmaintained ps-tree with something else like https://github.com/sindresorhus/fkill?

[mysticatea]

I have removed ps-tree in this dependency and published 4.1.4. (But 4.1.4 can be buggy because it does not kill descendant processes). The fkill's tree option looks supported only on Windows. I'm considering.

[XhmikosR]

Hmm, maybe it's not wise to have released it as a minor bump if if 4.1.4 is buggy?

[mysticatea]

I will try pidtree package and publish fixed version ASAP.

[mysticatea]

I have published 4.1.5. Thank you!