GHSA-x3m6-rprw-862w: 
JavaScript vulnerability analysis and mitigation

The node-buc package has been identified as a malicious package with critical severity (CVSS score 9.8). This vulnerability was discovered and published to the GitHub Advisory Database on September 3, 2020, with the identifier GHSA-x3m6-rprw-862w. The vulnerability affects all versions of the node-buc npm package (>= 0.0.0), with no patched versions available (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), with the following metrics: Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The technical vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-506 (GitHub Advisory).

The malicious package uploads system information to a remote server, downloads external files, and executes them on the affected system. This gives potential attackers complete control over the compromised system, allowing them to access sensitive information and potentially perform unauthorized actions (GitHub Advisory).

The vulnerability is highly exploitable as it requires no special privileges, user interaction, or complex attack vectors. The package is inherently malicious and performs its harmful actions upon installation or execution (GitHub Advisory).

Security experts recommend that any computer with this package installed or running should be considered fully compromised. All secrets and keys stored on the affected computer should be immediately rotated from a different computer. While the package should be removed, it's important to note that removing the package may not eliminate all malicious software resulting from its installation, as full control of the computer may have been given to an outside entity (GitHub Advisory).