GHSA-g5q2-fcg9-j526: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-g5q2-fcg9-j526 affects the npm package hsf-clients, which was identified as a malicious package. The issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. All versions of the package (>= 0.0.0) are affected, and there are no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3.1 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package uploads system information to a remote server, downloads a file, and executes it, potentially giving full control of the affected computer to malicious actors. Any computer with this package installed or running should be considered fully compromised (GitHub Advisory).

The package is inherently malicious and actively performs harmful actions upon installation. The low attack complexity and absence of required privileges or user interaction make it highly exploitable (GitHub Advisory).

It is recommended to immediately remove the package from affected systems. However, removal may not be sufficient as the system should be considered compromised. All secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised computer. Due to the nature of the compromise, there is no guarantee that removing the package will eliminate all malicious software resulting from its installation (GitHub Advisory).