2-loadsight-web

{"modified":"2026-08-23T03:27:39Z","published":"2026-08-23T03:22:00Z","schema_version":"1.7.4","id":"MAL-2026-14363","summary":"Malicious code in 2-loadsight-web (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5)\nThe package consists of a minimal HTML wrapper (index.html) whose only behavior is to fetch content from a hardcoded, unpinned URL at https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parse the returned HTML, and re-create every <script> element from the response as a live script tag in the host document, causing the fetched JavaScript to execute in the consuming page's origin. The 'raw/main/...' reference is a mutable branch with no commit pin, no hash check, and no signature verification, so the Bitbucket account 'p2p-alt-public' can substitute arbitrary code at any time. package.json has an empty author field and a generic 'Website loader for remote HTML content' description, and main points directly at the wrapper HTML.\n","affected":[{"package":{"ecosystem":"npm","name":"2-loadsight-web"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0bd895c55a890dbfcb9ca36ef255d88682e1ed12561db7c68379211f8f102278","tlsh":"f221ed2c0dab43371b2724a6437bda85753260073009d9d97a8ccb855f04b58cc57fc9"}],"package_integrity":[{"filename":"2-loadsight-web-1.0.0.tgz","hashes":{"sha1":"8a1f1e2ec26729e5c43811af1337bbbe852a6545","sha512_sri":"sha512-DKyoTUYC4pZXEGNCoSm7bqzgfUgGblu6jmwUwl5oQGqNCl+Ci+IIRsXwbBpsWL9BXspr19hAKfSUyKvvURzHhA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/2-loadsight-web/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/2-loadsight-web/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018582","import_time":"2026-08-23T03:25:57.420215008Z","modified_time":"2026-08-23T03:22:09Z","sha256":"57b646752857496fc26e1e5d3afab547f62ed43a612fb63fee2878d7fd1b0b09","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-018581","import_time":"2026-08-23T03:25:57.328415328Z","modified_time":"2026-08-23T03:22:00Z","sha256":"cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5","source":"amazon-inspector","versions":["1.0.1"]}]}}