GHSA-wgvj-6v57-wjh3: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package 'bowee' version 1.8.4, discovered and published to the GitHub Advisory Database on September 2, 2020. The vulnerability received a critical severity rating with a CVSS score of 9.8. This malicious package affected all versions greater than or equal to 0, with no patched versions available (GitHub Advisory).

The vulnerability was classified with a CVSS v3.1 base score of 9.8 (Critical), characterized by network attack vector, low attack complexity, no privileges required, and no user interaction needed. The technical assessment indicated high impact across confidentiality, integrity, and availability metrics. The vulnerability was identified as CWE-506, with the CVSS string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

The malicious package implemented a preinstall script that downloaded and executed a file from a remote server, establishing a backdoor. This gave potential attackers full control over the compromised system, allowing unauthorized access to secrets and keys stored on the affected computer (GitHub Advisory).

The vulnerability required no special privileges or user interaction to exploit, making it highly accessible to attackers. The attack vector was network-based with low complexity, indicating straightforward exploitation potential (GitHub Advisory).

Security experts recommend that any computer with this package installed should be considered fully compromised. All secrets and keys stored on the affected computer should be immediately rotated from a different, uncompromised system. While the package should be removed, it's important to note that removal may not eliminate all malicious software installed during the compromise (GitHub Advisory).