GHSA-c4hh-fg8x-6h9p: 
JavaScript vulnerability analysis and mitigation

The buffer-xnr package (version 2.0.2) was identified as a malicious package in the npm ecosystem. This security issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) and has been assigned the identifier GHSA-c4hh-fg8x-6h9p with a Critical severity rating (CVSS score: 9.8) (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), with the following characteristics: Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The technical vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package specifically targeted Ethereum cryptocurrency, executing unauthorized transactions to wallets not controlled by the legitimate user. This could result in financial losses for affected users through unauthorized cryptocurrency transfers (GitHub Advisory, NPM Advisory).

The vulnerability has a low attack complexity and requires no user interaction or special privileges to exploit, making it highly exploitable. The network-based attack vector means it can be triggered remotely (GitHub Advisory).

Users are strongly advised to completely remove the package from their environment. Additionally, it is recommended to verify that no Ethereum funds have been compromised. There are no patched versions available, as this is a malicious package rather than a vulnerability that can be fixed (GitHub Advisory).