GHSA-pmgv-94f5-6w7w: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-pmgv-94f5-6w7w) involves a malicious package named 'eact' that was identified as a typosquatting attack targeting a popular package with a similar name. The issue was discovered and published to the GitHub Advisory Database on September 2, 2020, with the last update on January 9, 2023. All versions of the package are affected, and there are no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package tracked users who inadvertently installed it by collecting and uploading information to a remote server. The collected data included the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges (GitHub Advisory).

The package was designed to exploit user typing mistakes (typosquatting) when installing packages. No additional compromise beyond information collection has been reported (GitHub Advisory).

Users are advised to remove the package from their dependencies immediately. To prevent similar issues, it is recommended to always ensure package names are typed correctly during installation (GitHub Advisory).