GHSA-7xc4-793x-25jp: 
JavaScript vulnerability analysis and mitigation

The bpi66 npm package has been identified as a malicious package (GHSA-7xc4-793x-25jp) that was designed to find and exfiltrate cryptocurrency wallets. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 4, 2020, and last updated on January 9, 2023. All versions of the package (>= 0.0.0) are affected, with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.1. The CVSS v3 base metrics indicate that the attack vector is Network-based, with low attack complexity, requiring no privileges or user interaction. The scope is unchanged, with high impact on both confidentiality and integrity, though no impact on availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The impact of this malicious package is severe as it specifically targets cryptocurrency wallets for exfiltration. Any computer that has installed or run this package should be considered fully compromised, with potential unauthorized access to all secrets and keys stored on the affected system (GitHub Advisory).

The package is inherently malicious by design, making it highly exploitable with no additional vulnerabilities needed. The attack complexity is rated as low, requiring no special privileges or user interaction for exploitation (GitHub Advisory).

Immediate action is required for affected systems. All secrets and keys stored on compromised computers should be rotated immediately from a different, unaffected computer. While the package should be removed, it's important to note that removal may not eliminate all malicious software resulting from its installation, as the system should be considered fully compromised (GitHub Advisory).