GHSA-6qc7-jgq7-34rf: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package 'exprss' (GHSA-6qc7-jgq7-34rf), which was discovered to be a malicious typosquatting package targeting users who mistyped the popular 'express' package name. The vulnerability was published to the GitHub Advisory Database on September 2, 2020, and last updated on January 9, 2023. This affects all versions of the package with no available patches (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is categorized under CWE-506 (GitHub Advisory).

When installed, the malicious package collects and transmits sensitive information to a remote server, including the name of the downloaded package, the intended package name, Node version information, and sudo execution status. While no further compromise has been reported, the unauthorized collection and transmission of system information poses a significant security risk (GitHub Advisory).

The vulnerability is easily exploitable through a simple typo during package installation, requiring no special privileges or user interaction beyond the initial installation of the package. The attack vector is network-based, making it accessible to remote attackers (GitHub Advisory).

Users are advised to immediately remove the 'exprss' package from their dependencies. To prevent similar issues, developers should carefully verify package names during installation to ensure they are using the intended legitimate packages. No patches are available as this is a malicious package that should be completely removed (GitHub Advisory).