GHSA-7xcv-wvr7-4h6p: 
JavaScript vulnerability analysis and mitigation

The npm package 'an0n-chat-lib' was identified as a malicious package and subsequently removed from the npm package registry. This security advisory was published on January 29, 2021, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available. The advisory was assigned the identifier GHSA-7xcv-wvr7-4h6p and was classified with Critical severity (GitHub Advisory).

The vulnerability is classified under CWE-506, indicating embedded malicious code. No CVE ID has been assigned to this security issue. The package was designed to compromise systems upon installation, potentially giving unauthorized access to external entities (GitHub Advisory).

Any system that has installed or executed this package should be considered fully compromised. The malware potentially allows external entities to gain complete control of the affected system, compromising all secrets and keys stored on the computer (GitHub Advisory).

The package was actively malicious, meaning it would compromise systems upon installation. The nature of the package suggests immediate exploitation upon installation, making it highly dangerous for any system that incorporated it (GitHub Advisory).

The primary mitigation step is to immediately remove the package from any system where it was installed. However, due to the nature of the compromise, removal of the package alone may not be sufficient to restore system security. All secrets and keys stored on affected computers should be rotated immediately, and this rotation should be performed from a different, uncompromised computer (GitHub Advisory).

The malware was identified and analyzed by Sonatype's security researchers, who documented it as part of a larger pattern of Discord-related malware in the npm ecosystem (Sonatype Blog).