GHSA-9mmw-3fmh-96g3: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-9mmw-3fmh-96g3) involves a malicious package named 'calk' that was discovered as a typosquatting attack on npm. The issue was identified and published to the GitHub Advisory Database on September 2, 2020, with the last update on January 9, 2023. This critical severity vulnerability affects all versions of the calk package (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is categorized under CWE-506 (GitHub Advisory).

The malicious package tracked users who inadvertently installed it by collecting and uploading sensitive information to a remote server. The collected data included the name of the downloaded package, the name of the intended package, Node version information, and sudo execution status (GitHub Advisory).

The package was designed as a typosquatting attack, targeting users who mistyped the name of a legitimate package. The exploitation requires no special privileges or user interaction beyond the initial installation of the compromised package (GitHub Advisory).

Users are advised to remove the package from their dependencies immediately. To prevent similar issues, it is recommended to carefully verify package names during installation to ensure they are typed correctly. No patches are available as this is a malicious package that should be completely removed (GitHub Advisory).