GHSA-rjhc-w3fj-j6x9: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-rjhc-w3fj-j6x9) was identified in the npm package 'alipayjsapi', affecting all versions (>=0.0.0) of the package. This critical severity issue was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The package was confirmed to contain malicious code that compromises system security (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package uploads system information to a remote server, downloads additional files, and executes them, potentially giving full control of the affected system to malicious actors. Any computer with this package installed should be considered fully compromised, with all stored secrets and keys at risk of exposure (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector, low attack complexity, and no requirement for privileges or user interaction. The package actively contains malicious code that executes automatically, making exploitation straightforward for attackers (GitHub Advisory).

There are no patched versions available. The recommended mitigation steps include: immediately removing the package from affected systems, rotating all secrets and keys stored on compromised computers from a different, secure system. However, it's noted that removing the package may not eliminate all malicious software installed during the compromise (GitHub Advisory).