GHSA-w8fh-pvq2-x8c4: 
JavaScript vulnerability analysis and mitigation

The npm package 'sonatype' was identified as a malicious package and subsequently removed from the npm package registry. This security incident was disclosed on January 29, 2021, and was assigned the identifier GHSA-w8fh-pvq2-x8c4. The vulnerability affects all versions of the package (>= 0.0.0), and no patched versions are available (GitHub Advisory).

The vulnerability has been classified as Critical severity and is associated with CWE-506. The malicious package was distributed through the npm registry, targeting Node.js developers. No CVE ID has been assigned to this security issue (GitHub Advisory).

Any system that has installed or executed this package should be considered fully compromised. The malware potentially grants full control of the affected computer to malicious actors, compromising all secrets and keys stored on the system (GitHub Advisory).

The package was actively distributed through the npm registry as malware, making it directly exploitable upon installation. The malicious nature of the package suggests immediate exploitation upon installation, though specific details of exploitation in the wild are not publicly documented (GitHub Advisory).

The recommended remediation steps include immediately rotating all secrets and keys stored on affected systems, with the rotation being performed from an uncompromised computer. While the package should be removed from affected systems, it's important to note that removal may not eliminate all malicious software installed during the compromise. Due to the potential for complete system compromise, affected systems may require complete rebuilding to ensure security (GitHub Advisory).