GHSA-g9wf-393q-4w38: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-g9wf-393q-4w38) affects the npm package 'only-test-not-install' and was identified as a malicious package containing harmful code. The issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. All versions of the package (>= 0.0.0) are affected, and there are no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506. The malicious package executes a postinstall script that deletes the ~/test folder from the system (GitHub Advisory).

The malicious package has a severe impact on system integrity by deleting the ~/test directory during installation. This unauthorized file deletion can potentially cause data loss and system disruption. The high CVSS metrics for Confidentiality, Integrity, and Availability indicate significant potential impact on affected systems (GitHub Advisory).

The vulnerability is easily exploitable with network access, requiring low attack complexity and no special privileges or user interaction. The attack vector is classified as Network, making it remotely exploitable (GitHub Advisory).

The recommended mitigation is to completely remove the package from the environment. No alternative patches or workarounds are available, as all versions are affected. After removal, there are no further signs of compromise that need to be addressed (GitHub Advisory).