GHSA-7xf6-cpxm-5mx9: 
JavaScript vulnerability analysis and mitigation

The bufner-xor package on npm was identified as containing malicious code in version 2.0.2. This security issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) and has been assigned the identifier GHSA-7xf6-cpxm-5mx9. The issue was reviewed on August 31, 2020, and received a Critical severity rating (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3.1 base metrics indicate the following characteristics: Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package specifically targeted Ethereum cryptocurrency, executing unauthorized transactions to wallets not controlled by the legitimate user. This could result in financial losses for affected users through unauthorized cryptocurrency transfers (GitHub Advisory).

The vulnerability has a low attack complexity and requires no user interaction or special privileges to exploit, making it highly exploitable. The attack can be performed remotely through the network, increasing its potential impact (GitHub Advisory).

Users are strongly advised to completely remove the package from their environment. Additionally, it is recommended to verify that no Ethereum funds have been compromised. No patched versions are available, as this is a malicious package rather than a vulnerability that can be fixed (GitHub Advisory).