3-buildsight-web

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545)
The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL, https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, on the mutable `main` branch. The parsed HTML is injected into the DOM and <script> nodes are re-created and appended to document.body, causing the remote JavaScript to execute in the consuming page's context. The reference is unpinned (no commit hash, tag, or integrity check), and the Bitbucket workspace (p2p-alt-public) is not aligned with any recognizable publisher. Whoever controls that branch can substitute arbitrary JavaScript at any time; each load of any application that imports this package will execute whatever bytes the branch currently serves, with the full privileges of that page.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/3-buildsight-web/MAL-2026-14364.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/3-buildsight-web/MAL-2026-14364.json
- https://www.npmjs.com/package/3-buildsight-web/v/1.0.0
- https://www.npmjs.com/package/3-buildsight-web/v/1.0.1
- https://github.com/advisories/GHSA-p6pp-6xxg-295v

Compromised versions (1)

• = 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.