GHSA-w65v-hx54-xrqx: 
JavaScript vulnerability analysis and mitigation

The vulnerability identified as GHSA-w65v-hx54-xrqx affects the npm package midway-xtpl. This critical severity vulnerability was discovered and published to the GitHub Advisory Database on September 3, 2020, with the latest update on January 9, 2023. The vulnerability affects all versions of the package (>= 0.0.0), with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate that the vulnerability has a Network attack vector, Low attack complexity, requires No privileges, needs No user interaction, has Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious package uploads system information to a remote server, downloads files, and executes them, potentially giving full control of the affected system to malicious actors. Any computer with this package installed or running should be considered fully compromised, with all secrets and keys stored on that computer at risk of exposure (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector and requires no special privileges or user interaction. The attack complexity is rated as low, making it relatively straightforward for attackers to exploit (GitHub Advisory).

The package should be immediately removed from affected systems. However, due to the nature of the malicious code, removing the package may not be sufficient to eliminate all malicious software resulting from its installation. It is recommended that all secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised computer (GitHub Advisory).