Backdoored dependency event-stream > 3.3.4

[shaan1337]

dominictarr/event-stream#116

event-stream > 3.3.4 is affected, so pinning event-stream to 3.3.4 should be fine.

[jorrit]

Thanks!