GHSA-g8jc-mm3c-cwhj: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package 'reques', tracked as GHSA-g8jc-mm3c-cwhj. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 2, 2020, and last updated on January 9, 2023. This package was identified as a typosquatting attack targeting a popular package with a similar name (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package collected and transmitted sensitive information to a remote server, including the name of the downloaded package, the intended package name, Node version information, and sudo execution status. The vulnerability affects all versions of the 'reques' package (GitHub Advisory, NPM Advisory).

The package was specifically designed as a typosquatting attack, making it easily exploitable through simple installation mistakes. No additional exploitation techniques were required as the malicious code executed automatically upon package installation (GitHub Advisory).

Users are advised to immediately remove the package from their dependencies. There are no patched versions available as this is a malicious package. The primary mitigation strategy is to ensure package names are typed correctly during installation and verify the authenticity of packages before installation (GitHub Advisory).