GHSA-5jgp-pg4f-q8vj: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the node-ftp npm package (GHSA-5jgp-pg4f-q8vj), which was discovered to contain malicious code. The issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0), and notably, there are no patched versions available (GitHub Advisory, NPM Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS base metrics indicate a Network attack vector with Low attack complexity, requiring No privileges and No user interaction. The scope is Unchanged, but the impact is High across all three security objectives: Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package was designed to collect and exfiltrate system information, including operating system details and hostname, to a remote server. This unauthorized data collection poses significant privacy and security risks to affected systems (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector and low attack complexity. No special privileges or user interaction is required for exploitation, making it particularly dangerous (GitHub Advisory).

The recommended mitigation strategy is to completely remove the package from the environment. Security advisories indicate that there are no signs of further compromise beyond the identified malicious behavior. No alternative patches or workarounds are available, as this is a deliberately malicious package (GitHub Advisory).