GHSA-jh67-3wqw-cvhr: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-jh67-3wqw-cvhr affects the npm package js-sxa3, which was discovered to contain malicious code in version 0.8.0. The issue was reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. This critical severity vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package specifically targets Ethereum cryptocurrency, performing unauthorized transactions to wallets not controlled by the user, potentially leading to financial losses. The high CVSS metrics across confidentiality, integrity, and availability indicate severe potential impact on affected systems (GitHub Advisory).

The vulnerability has a low attack complexity and requires no user interaction or special privileges to exploit, making it highly exploitable. The network attack vector suggests that the malicious code can be triggered remotely (GitHub Advisory).

Users are strongly advised to completely remove the package from their environment and verify that no Ethereum funds have been compromised. There are no patched versions available, making complete removal the only effective mitigation strategy (GitHub Advisory).