GHSA-277p-xwpp-3jf7: 
JavaScript vulnerability analysis and mitigation

The rrgod npm package has been identified as a malicious package (GHSA-277p-xwpp-3jf7) that was discovered and published to the GitHub Advisory Database on September 2, 2020. All versions of the package (>= 0.0.0) are affected, and there are no patched versions available. The vulnerability was reviewed on August 31, 2020, and last updated on January 9, 2023 (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The package functions as malware designed to execute arbitrary scripts. Upon installation, it downloads arbitrary files and executes their contents as pre, post, and install scripts, potentially leading to system compromise (GitHub Advisory).

The package is inherently malicious and requires no special conditions for exploitation. It automatically executes its malicious payload during the installation process, with no privileges or user interaction required (GitHub Advisory).

The package has been removed from the npm Registry. If this package is discovered in any environment, the system should be considered compromised, and appropriate incident response measures should be taken, including the rotation of all credentials found on the compromised machine (GitHub Advisory).