3-buildsight-web

{"modified":"2026-08-23T03:27:39Z","published":"2026-08-23T03:21:28Z","schema_version":"1.7.4","id":"MAL-2026-14364","summary":"Malicious code in 3-buildsight-web (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545)\nThe package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL, https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, on the mutable `main` branch. The parsed HTML is injected into the DOM and <script> nodes are re-created and appended to document.body, causing the remote JavaScript to execute in the consuming page's context. The reference is unpinned (no commit hash, tag, or integrity check), and the Bitbucket workspace (p2p-alt-public) is not aligned with any recognizable publisher. Whoever controls that branch can substitute arbitrary JavaScript at any time; each load of any application that imports this package will execute whatever bytes the branch currently serves, with the full privileges of that page.\n","affected":[{"package":{"ecosystem":"npm","name":"3-buildsight-web"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0bd895c55a890dbfcb9ca36ef255d88682e1ed12561db7c68379211f8f102278","tlsh":"f221ed2c0dab43371b2724a6437bda85753260073009d9d97a8ccb855f04b58cc57fc9"}],"package_integrity":[{"filename":"3-buildsight-web-1.0.1.tgz","hashes":{"sha1":"e1697fd7c388dd28d33dca6e43478bbed9bbf5de","sha512_sri":"sha512-UWW3CsI6O/2ycYDCCdwSxkU+tMHjQnmfV7DuIRt4vAdAr1EQROV8GwGDBa+kwMIOMJLZnwUNVNtn9rxNx2HaNA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/3-buildsight-web/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/3-buildsight-web/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018580","import_time":"2026-08-23T03:25:57.232986669Z","modified_time":"2026-08-23T03:21:53Z","sha256":"0f435f7ff0c81d13ca0536b5a22774662c22b67a7f06d58b78a81e2298b739a2","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-018577","import_time":"2026-08-23T03:25:56.964050732Z","modified_time":"2026-08-23T03:21:28Z","sha256":"ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545","source":"amazon-inspector","versions":["1.0.0"]}]}}