GHSA-r742-7j4h-hjr8: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-r742-7j4h-hjr8) was identified in the npm package 'arsenic-tabasco-cyborg-peanut-butter'. This malicious package was discovered and published to the GitHub Advisory Database on September 3, 2020, with the latest update on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package contains code that downloads and executes a script that creates a reverse shell in the system, potentially giving attackers complete control over the compromised system. This leads to potential unauthorized access, data breach, and system compromise (GitHub Advisory).

The package is inherently malicious, requiring no special conditions for exploitation. Once installed, it automatically downloads and executes malicious code, opening a reverse shell that gives attackers system access (GitHub Advisory).

Any system with this package installed should be considered fully compromised. It is recommended to immediately rotate all secrets and keys stored on the affected system from a different computer. While the package should be removed, there is no guarantee that removal will eliminate all malicious software installed during its execution (GitHub Advisory).