GHSA-7qg7-6g3g-8vxg: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-7qg7-6g3g-8vxg) was identified in the npm package bwffer-xor, specifically in version 2.0.2. The issue was discovered and reviewed on August 31, 2020, and subsequently published to the GitHub Advisory Database on September 3, 2020, with the latest update occurring on January 9, 2023. This vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate a Network attack vector with Low attack complexity, requiring No privileges and No user interaction. The scope is Unchanged, but the impact is High across all three security objectives: Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package specifically targeted Ethereum cryptocurrency, executing unauthorized transactions to wallets not controlled by the user. This could result in financial losses for affected users through unauthorized cryptocurrency transfers (GitHub Advisory).

The package contains malicious code in version 2.0.2 that actively performs unauthorized Ethereum transactions. The exploitation requires no special privileges or user interaction, making it highly exploitable (GitHub Advisory).

Users are strongly advised to completely remove the package from their environment. After removal, it is recommended to verify that no Ethereum funds have been compromised. There are no patched versions available, so the only mitigation is complete removal of the package (GitHub Advisory).