GHSA-p5p2-rhc3-wmf3: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-p5p2-rhc3-wmf3 pertains to a malicious package named 'siganle' discovered in the npm ecosystem. This critical severity issue was identified and published to the GitHub Advisory Database on September 3, 2020, with the latest update on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0), with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.1. The CVSS v3 base metrics indicate a Network attack vector with Low attack complexity, requiring No privileges and No user interaction. The scope is Unchanged, with High impact on both Confidentiality and Integrity, while having No impact on Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package was specifically designed to find and exfiltrate cryptocurrency wallets from infected systems. Any computer with this package installed or running should be considered fully compromised, potentially giving full control to malicious actors (GitHub Advisory).

The package is inherently malicious, requiring no exploitation as its malicious functionality is built into all versions. The low attack complexity and absence of required privileges or user interaction make this particularly dangerous (GitHub Advisory).

Due to the severity of this malicious package, immediate action is required. All secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised computer. While the package should be removed, it's important to note that removal may not eliminate all malicious software resulting from its installation, as the system should be considered fully compromised (GitHub Advisory).