GHSA-p8fm-w787-x6x3: 
JavaScript vulnerability analysis and mitigation

The vulnerability GHSA-p8fm-w787-x6x3 pertains to a malicious npm package named 'portionfatty12'. This critical security issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 2, 2020, and last updated on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package is designed to steal user data by specifically targeting and uploading the user's public SSH keys to a remote server when installed. This compromises the security of affected systems and potentially enables unauthorized access to user accounts and resources (GitHub Advisory).

The package is confirmed to be malware, with exploitation occurring automatically upon installation. No special conditions or user interactions are required for the malicious code to execute, making it highly exploitable (GitHub Advisory).

The package has been removed from the npm Registry. If this package is discovered in any environment, the system should be considered compromised. It is recommended to conduct a thorough security assessment and rotate all credentials found on the compromised machine (GitHub Advisory).