GHSA-4hfc-fv33-ph9p: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-4hfc-fv33-ph9p affects the npm package sj-tw-abc, which was identified as a malicious package. This critical severity vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3.1 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package downloads and executes a script that creates a reverse shell in the system, potentially giving attackers full control of the compromised system. Any computer with this package installed or running should be considered fully compromised, with all secrets and keys stored on that computer potentially exposed (GitHub Advisory).

The package contains malicious code that is automatically executed upon installation, requiring no additional user interaction or privileges for exploitation. The attack vector is network-based with low complexity, making it highly exploitable (GitHub Advisory).

There are no patched versions available. The recommended mitigation steps include: immediately removing the package from affected systems, rotating all secrets and keys stored on the compromised computer from a different system, and being aware that removing the package may not eliminate all malicious software resulting from its installation (GitHub Advisory).