GHSA-x48m-gp6r-gp4v: 
JavaScript vulnerability analysis and mitigation

The rate-map package version 1.0.3 was identified as containing malicious code, as documented in GitHub Security Advisory GHSA-x48m-gp6r-gp4v. This vulnerability was published on September 3, 2020, and last updated on January 9, 2023. The affected package is distributed through the npm registry, with version 1.0.3 specifically identified as compromised (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and has high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

The malicious code in rate-map version 1.0.3 specifically targets and breaks the functionality of the purescript-installer package by manipulating the code of its dl-tar dependency (GitHub Advisory).

The vulnerability presents a significant exploitation risk due to its network attack vector, low attack complexity, and the fact that it requires no privileges or user interaction to exploit. These characteristics contribute to its Critical severity rating (GitHub Advisory).

Users are strongly advised to upgrade to version 1.0.5 or later of the rate-map package. The advisory indicates there is no evidence of further compromise beyond the identified malicious version (GitHub Advisory).