Removed: nothing. A package thousands of projects already depended on never had to justify its place, so a change of maintainer went through without anyone noticing.
Outcome: thousands of projects compromised. The malicious code targeted cryptocurrency wallets, and it arrived through a development dependency.
The event-stream npm package attack compromised thousands of projects because developers trusted a popular package without noticing a maintainer change. Nobody made a bad decision at the point of infection; the decision had been made years earlier, when the dependency was added and then never looked at again.
That is the shape of most supply chain incidents. The exposure is not the one package you evaluated. It is the transitive set you inherited and stopped counting, which is why the cheapest reduction is the dependency you never add.
Source: npm, Details about the event-stream incident (26 November 2018)