GHSA-28f4-mjfq-qrvf: 
JavaScript vulnerability analysis and mitigation

The buffes-xor package (version 2.0.2) was identified as a malicious package that specifically targeted Ethereum cryptocurrency users. This critical security issue was discovered and published to the GitHub Advisory Database on September 3, 2020, with the identifier GHSA-28f4-mjfq-qrvf. The vulnerability affects all versions of the package (>= 0.0.0), and notably, no patched versions are available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS base metrics indicate a network attack vector with low attack complexity, requiring no privileges or user interaction. The vulnerability maintains unchanged scope while having high impact on confidentiality, integrity, and availability. The weakness has been categorized as CWE-506 (GitHub Advisory).

The malicious package was designed to perform unauthorized Ethereum cryptocurrency transactions, directing funds to wallets not controlled by the legitimate user. This poses a direct financial risk to users who have integrated this package into their applications (GitHub Advisory).

The package contains deliberately malicious code that executes automatically, requiring no special conditions or user interaction for exploitation. The attack vector is accessible over the network with low complexity, making it highly exploitable (GitHub Advisory).

Users are strongly advised to completely remove the package from their environment. After removal, it is recommended to conduct a thorough review to ensure no Ethereum funds have been compromised (GitHub Advisory).