GHSA-4964-cjrr-jg97: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability (GHSA-4964-cjrr-jg97) was identified in the npm package 'jqeury' version 3.3.1. This malicious package was designed to exploit users who mistakenly type the wrong name when attempting to install the legitimate 'jquery' package. The vulnerability was published to the GitHub Advisory Database on September 2, 2020, and last updated on January 9, 2023 (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506. When installed, the package executes a malicious preinstall script that downloads and executes a file from a remote server, establishing a backdoor (GitHub Advisory).

The impact of this vulnerability is severe as any computer that has this package installed or running should be considered fully compromised. The malicious package can potentially give full control of the affected system to malicious actors, compromising all secrets and keys stored on the computer (GitHub Advisory).

The package is actively malicious and requires no special conditions for exploitation. It is triggered automatically during the installation process through the preinstall script, requiring no user interaction beyond the initial package installation (GitHub Advisory).

There are no patched versions available as this is a malicious package rather than a vulnerable one. The recommended mitigation steps include immediately removing the package from any system where it has been installed. However, since the system should be considered fully compromised, removing the package may not be sufficient to eliminate all malicious software. All secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system (GitHub Advisory).