GHSA-73wv-v82c-xmqv: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-73wv-v82c-xmqv affects the npm package buffep-xor, specifically version 2.0.2, which was identified as containing malicious code. The issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. This critical severity vulnerability affects all versions (>= 0.0.0) of the package, with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate a Network attack vector, Low attack complexity, No privileges required, and No user interaction needed. The scope is unchanged, but the impact is High for all three security properties: Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package specifically targets Ethereum cryptocurrency, performing unauthorized transactions to wallets not controlled by the user. This poses a direct financial risk to users who have integrated this package into their applications, potentially resulting in the loss of Ethereum funds (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector and low attack complexity. No special privileges or user interaction is required for exploitation, making it particularly dangerous. The malicious code is actively present in version 2.0.2 of the package (GitHub Advisory).

The recommended mitigation strategy is to completely remove the package from your environment. Users should also conduct a thorough review to ensure no Ethereum funds have been compromised. No patched versions are available, indicating that the package should not be used in any form (GitHub Advisory).