GHSA-8gc6-65mm-xr6r: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-8gc6-65mm-xr6r pertains to a malicious package named 'bp66' in the npm ecosystem. This critical severity issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 4, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the bp66 package (>= 0.0.0), with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.1. The CVSS v3 base metrics indicate a Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, High impact on both Confidentiality and Integrity, and No impact on Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package was specifically designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised, with potential unauthorized access to all secrets and keys stored on the affected system (GitHub Advisory).

The package is inherently malicious, requiring no exploitation as its malicious functionality is built into all versions. The low attack complexity and absence of required privileges or user interaction make this particularly dangerous (GitHub Advisory).

Due to the severity of this malicious package, immediate action is required. All secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised computer. While the package should be removed, it's important to note that removal may not eliminate all malicious software resulting from its installation, as full control of the computer may have been given to an outside entity (GitHub Advisory).