MAL-2026-14364

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/3-buildsight-web/MAL-2026-14364.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14364
Published
2026-08-23T03:21:28Z
Modified
2026-08-23T03:30:22.461551406Z
Summary
Malicious code in 3-buildsight-web (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545)

The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL, https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, on the mutable main branch. The parsed HTML is injected into the DOM and <script> nodes are re-created and appended to document.body, causing the remote JavaScript to execute in the consuming page's context. The reference is unpinned (no commit hash, tag, or integrity check), and the Bitbucket workspace (p2p-alt-public) is not aligned with any recognizable publisher. Whoever controls that branch can substitute arbitrary JavaScript at any time; each load of any application that imports this package will execute whatever bytes the branch currently serves, with the full privileges of that page.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-23T03:25:57.232986669Z",
            "modified_time": "2026-08-23T03:21:53Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018580",
            "sha256": "0f435f7ff0c81d13ca0536b5a22774662c22b67a7f06d58b78a81e2298b739a2"
        },
        {
            "sha256": "ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "modified_time": "2026-08-23T03:21:28Z",
            "id": "IN-MAL-2026-018577",
            "import_time": "2026-08-23T03:25:56.964050732Z"
        }
    ]
}
References
Credits

Affected packages

npm / 3-buildsight-web

Package

Name
3-buildsight-web
View open source insights on deps.dev
Purl
pkg:npm/3-buildsight-web

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/3-buildsight-web/MAL-2026-14364.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "0bd895c55a890dbfcb9ca36ef255d88682e1ed12561db7c68379211f8f102278",
            "tlsh": "f221ed2c0dab43371b2724a6437bda85753260073009d9d97a8ccb855f04b58cc57fc9"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "e1697fd7c388dd28d33dca6e43478bbed9bbf5de",
                "sha512_sri": "sha512-UWW3CsI6O/2ycYDCCdwSxkU+tMHjQnmfV7DuIRt4vAdAr1EQROV8GwGDBa+kwMIOMJLZnwUNVNtn9rxNx2HaNA=="
            },
            "filename": "3-buildsight-web-1.0.1.tgz"
        }
    ]
}