GHSA-hg7w-2pf7-mxm2: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-hg7w-2pf7-mxm2 affects the npm package 'wbe3', which was identified as a malicious package. The issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. All versions of the package (>= 0.0.0) are affected, with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.1. The CVSS v3 base metrics indicate a Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, High impact on both Confidentiality and Integrity, and No impact on Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package was specifically designed to find and exfiltrate cryptocurrency wallets. Any computer that has this package installed or running should be considered fully compromised, with potential unauthorized access to all secrets and keys stored on the affected system (GitHub Advisory).

The package is inherently malicious and requires no exploitation as it contains built-in malware. The attack vector is network-based with low complexity, requiring no special privileges or user interaction to execute its malicious functionality (GitHub Advisory).

The recommended mitigation steps include immediate removal of the package from affected systems. However, removal alone may not be sufficient as the system should be considered compromised. All secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. It's important to note that due to potential full system compromise, there is no guarantee that removing the package will eliminate all malicious software resulting from its installation (GitHub Advisory).