Poisoned event-stream dependency

[oliversalzburg]

This is regarding https://github.com/dominictarr/event-stream/issues/116

[email protected] depends on event-stream@^3.3.4. This has the potential to resolve its dependency on flatmap-stream@^0.1.0 to a version that included the malware.

The dependency version should probably be locked down to 3.3.4 at this time.