GHSA-65j7-66p7-9xgf: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package font-scrubber (GHSA-65j7-66p7-9xgf), specifically in version 1.2.2. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 2, 2020, and last updated on January 9, 2023. The package was found to contain malicious code embedded in its postinstall script, affecting all versions (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package attempts to exfiltrate sensitive files from the affected system to a remote server. The targeted files include system configuration files, command history logs, SSH keys, and the /etc/passwd file. This comprehensive data theft can lead to complete system compromise (GitHub Advisory).

The vulnerability is automatically exploited upon package installation through the postinstall script, requiring no additional user interaction or privileges. The attack vector is network-based, making it highly exploitable (GitHub Advisory).

Any system with this package installed should be considered fully compromised. It is recommended to immediately rotate all secrets and keys from an unaffected computer. While the package should be removed, it's important to note that removal may not eliminate all malicious software installed during the compromise. There are no patched versions available (GitHub Advisory).