GHSA-whjr-jj69-7prm: 
JavaScript vulnerability analysis and mitigation

The import-mysql package was identified as containing malicious code that compromised system security. This vulnerability, tracked as GHSA-whjr-jj69-7prm, was discovered and published to the GitHub Advisory Database on September 3, 2020, with the latest update on January 9, 2023. The package affected all versions (>= 0.0.0) of import-mysql on the npm registry (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate that the vulnerability requires network access, has low attack complexity, requires no privileges, and needs no user interaction. The scope is unchanged, but the impact on confidentiality, integrity, and availability is rated as High. The vulnerability is associated with CWE-506 (GitHub Advisory).

When exploited, the malicious package collected and transmitted system information, including operating system details and hostname, to a remote server. This unauthorized data collection posed significant risks to system confidentiality and security (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector, low attack complexity, and the fact that it requires no privileges or user interaction to execute. The package actively collected and transmitted system information without user consent (GitHub Advisory).

The recommended mitigation is to completely remove the package from the environment. No patched versions are available, and the package should not be used. According to the advisory, there are no indications of further compromise beyond the identified malicious behavior (GitHub Advisory).