GHSA-6c37-2rw5-9j7x: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-6c37-2rw5-9j7x) involves a malicious package named 'requesst' that was identified as a typosquatting attack on a similarly named popular package. This critical severity issue was discovered and published to the GitHub Advisory Database on September 2, 2020, with the latest update on January 9, 2023. The vulnerability affects all versions of the requesst package (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

When installed, the malicious package tracks users and uploads sensitive information to a remote server. The collected information includes the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges (GitHub Advisory).

The vulnerability is easily exploitable through package installation, requiring no special privileges or user interaction. The attack vector is network-based, and the attack complexity is rated as low, making it highly exploitable (GitHub Advisory).

Users are advised to remove the package from their dependencies immediately. The primary mitigation strategy is to ensure package names are typed correctly during installation. No patches are available as this is a malicious package, and the solution is to remove it entirely (GitHub Advisory).