MAL-2026-14365

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/6-viewsight-web/MAL-2026-14365.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14365
Published
2026-08-23T03:21:09Z
Modified
2026-08-23T03:30:23.852159429Z
Summary
Malicious code in 6-viewsight-web (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68)

The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and injects it into the consuming page's DOM, re-creating each <script> element so its contents execute in the page's JavaScript context. The URL points at the mutable main branch with no version pin, hash, or signature check, so whoever controls the p2p-alt-public/p2p-emis Bitbucket repository can change the payload at any time and have it run in every application that loads this package. package.json ships with empty author metadata, MIT default, and a generic 'Website loader for remote HTML content' description, and there is no relationship between the publishing npm identity and the Bitbucket account hosting the fetched code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "4f0e3936b569eac18de722786b9fb7582c5be13f30a3f754bf283f2ab2761e64",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ],
            "modified_time": "2026-08-23T03:21:09Z",
            "id": "IN-MAL-2026-018575",
            "import_time": "2026-08-23T03:25:56.783679756Z"
        },
        {
            "sha256": "96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68",
            "modified_time": "2026-08-23T03:21:45Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018579",
            "import_time": "2026-08-23T03:25:57.142802283Z"
        }
    ]
}
References
Credits

Affected packages

npm / 6-viewsight-web

Package

Name
6-viewsight-web
View open source insights on deps.dev
Purl
pkg:npm/6-viewsight-web

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/6-viewsight-web/MAL-2026-14365.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.html",
            "sha256": "7ca3f9365fb88e816da0eb8d7fa388f2752d37ad8b650fb3c7224f260a204154",
            "tlsh": "8631eb2c0dab83371b222496537bd689753250073005d9d97acccb855f44b59cc47fc9"
        },
        {
            "path": "index.js",
            "sha256": "0bd895c55a890dbfcb9ca36ef255d88682e1ed12561db7c68379211f8f102278",
            "tlsh": "f221ed2c0dab43371b2724a6437bda85753260073009d9d97a8ccb855f04b58cc57fc9"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "a0a2dccb2f8715640188f65c0371b8f0eebee080",
                "sha512_sri": "sha512-nJLHmShduUv2V/OQnzjwHshl9C87HOJ8BqRYkjIWAlWPmnUjUMgVB6Fn2ZgzZ3tBKQjhs9g2JAc9+L9N1gtKGA=="
            },
            "filename": "6-viewsight-web-1.0.1.tgz"
        }
    ]
}