GHSA-2mxc-m4c3-wqhq: 
JavaScript vulnerability analysis and mitigation

The ruffer-xor npm package was identified as containing malicious code in version 2.0.2. This security issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS base metrics indicate a Network attack vector with Low attack complexity, requiring No privileges and No user interaction. The scope is Unchanged, but the impact is High across all three security objectives: Confidentiality, Integrity, and Availability. The vulnerability is categorized under CWE-506 (GitHub Advisory).

The malicious package specifically targeted Ethereum cryptocurrency, executing unauthorized transactions to wallets not controlled by the legitimate user, potentially leading to financial losses (GitHub Advisory).

The package is inherently malicious, with exploitation requiring no special privileges or user interaction. The attack vector is network-based with low complexity, making it highly exploitable (GitHub Advisory).

Users are strongly advised to completely remove the package from their environment and verify that no Ethereum funds have been compromised. There are no patched versions available as the package is intentionally malicious (GitHub Advisory).