GHSA-73c6-vwjh-g3qh: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-73c6-vwjh-g3qh pertains to a malicious package named 'crpyto-js' that was discovered and published to the GitHub Advisory Database on September 3, 2020. This critical severity vulnerability affects all versions of the package (>= 0.0.0), with no patched versions available. The malicious package was specifically designed to target and exfiltrate cryptocurrency wallets (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.1. The CVSS v3 base metrics indicate a Network attack vector with Low attack complexity, requiring No privileges and No user interaction. The scope is Unchanged, with High impact on both Confidentiality and Integrity, while having No impact on Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The impact of this malicious package is severe as it compromises the entire system where it's installed. Any computer with this package installed or running should be considered fully compromised, with potential unauthorized access to all secrets and keys stored on the affected system (GitHub Advisory).

The package is inherently malicious, designed specifically for cryptocurrency wallet theft. Its exploitation requires no special privileges or user interaction, making it highly exploitable once installed (GitHub Advisory).

The recommended mitigation steps include immediate removal of the package from affected systems. However, removal alone may not be sufficient as the system should be considered compromised. All secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised computer. Due to the potential for full system compromise, there is no guarantee that removing the package will eliminate all malicious software resulting from its installation (GitHub Advisory).