GHSA-8hrq-9wm7-v3jw: 
JavaScript vulnerability analysis and mitigation

The btffer-xor package on npm was identified as containing malicious code in version 2.0.2. This security issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package specifically targeted Ethereum cryptocurrency, executing unauthorized transactions to wallets not controlled by the legitimate user, potentially resulting in financial losses (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector, low attack complexity, and requiring no privileges or user interaction for exploitation. The package was confirmed to contain malicious code that actively performed unauthorized cryptocurrency transactions (GitHub Advisory).

Users are strongly advised to completely remove the package from their environment and verify that no Ethereum funds have been compromised. There are no patched versions available, and the only mitigation strategy is complete removal of the package (GitHub Advisory).