GHSA-725f-3pw7-rq6x: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package '8.9.4', tracked as GHSA-725f-3pw7-rq6x. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The affected versions include 1.0.2, 1.0.3, 1.0.4, and 1.0.5 of the package (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS base metrics indicate a Network attack vector with Low attack complexity, requiring No privileges and No user interaction. The scope is Unchanged, but the impact is High across Confidentiality, Integrity, and Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package contains a preinstall script that reads the system's SSH keys, although it has been confirmed that the keys are not uploaded to any remote server. This poses a significant security risk as it attempts to access sensitive authentication credentials (GitHub Advisory).

The vulnerability is highly exploitable due to its Network attack vector and Low attack complexity. No special privileges or user interaction is required to exploit this vulnerability, making it particularly dangerous (GitHub Advisory).

The recommended mitigation is to completely remove the package from your environment. There are no patched versions available, and users should immediately remove any instances of this package. There is currently no evidence of further compromise beyond the SSH key reading functionality (GitHub Advisory).