GHSA-fgfj-rj24-mj7q: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in kraken-api version 0.1.8, tracked as GHSA-fgfj-rj24-mj7q. The vulnerability was discovered and published to the GitHub Advisory Database on September 2, 2020, with the latest update on July 27, 2023. This security issue affects the npm package kraken-api specifically in version 0.1.8 (GitHub Advisory, NPM Advisory).

The vulnerability involves malicious code embedded in the package's postinstall script. When the compromised package is installed, it establishes communication with a Command and Control (C2) server, enabling the execution of arbitrary commands on the affected system (GitHub Advisory).

Systems with the compromised package installed are considered fully compromised, potentially giving complete control to malicious actors. All secrets and keys stored on affected systems should be considered exposed (GitHub Advisory).

The vulnerability is automatically exploited upon package installation, requiring no additional user interaction. The malicious code is triggered through the postinstall script, making exploitation straightforward and immediate (GitHub Advisory).

Users are advised to immediately remove the package, though this may not eliminate all malicious software installed by the package. It is recommended to downgrade to version 0.1.7. Additionally, all secrets and keys stored on affected systems should be rotated immediately from an uncompromised computer (GitHub Advisory).