6-viewsight-web

{"modified":"2026-08-23T03:27:39Z","published":"2026-08-23T03:21:09Z","schema_version":"1.7.4","id":"MAL-2026-14365","summary":"Malicious code in 6-viewsight-web (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68)\nThe package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and injects it into the consuming page's DOM, re-creating each <script> element so its contents execute in the page's JavaScript context. The URL points at the mutable `main` branch with no version pin, hash, or signature check, so whoever controls the `p2p-alt-public/p2p-emis` Bitbucket repository can change the payload at any time and have it run in every application that loads this package. package.json ships with empty author metadata, MIT default, and a generic 'Website loader for remote HTML content' description, and there is no relationship between the publishing npm identity and the Bitbucket account hosting the fetched code.\n","affected":[{"package":{"ecosystem":"npm","name":"6-viewsight-web"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.html","sha256":"7ca3f9365fb88e816da0eb8d7fa388f2752d37ad8b650fb3c7224f260a204154","tlsh":"8631eb2c0dab83371b222496537bd689753250073005d9d97acccb855f44b59cc47fc9"},{"path":"index.js","sha256":"0bd895c55a890dbfcb9ca36ef255d88682e1ed12561db7c68379211f8f102278","tlsh":"f221ed2c0dab43371b2724a6437bda85753260073009d9d97a8ccb855f04b58cc57fc9"}],"package_integrity":[{"filename":"6-viewsight-web-1.0.1.tgz","hashes":{"sha1":"a0a2dccb2f8715640188f65c0371b8f0eebee080","sha512_sri":"sha512-nJLHmShduUv2V/OQnzjwHshl9C87HOJ8BqRYkjIWAlWPmnUjUMgVB6Fn2ZgzZ3tBKQjhs9g2JAc9+L9N1gtKGA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/6-viewsight-web/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/6-viewsight-web/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018575","import_time":"2026-08-23T03:25:56.783679756Z","modified_time":"2026-08-23T03:21:09Z","sha256":"4f0e3936b569eac18de722786b9fb7582c5be13f30a3f754bf283f2ab2761e64","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-018579","import_time":"2026-08-23T03:25:57.142802283Z","modified_time":"2026-08-23T03:21:45Z","sha256":"96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68","source":"amazon-inspector","versions":["1.0.0"]}]}}