MAL-2026-14364

    Dashboard / Malicious Package / MAL-2026-14364

    MAL-2026-14364

    Published: 23 Aug 2026Last Modified: 23 Aug 2026

    Summary: Malicious code in 3-buildsight-web (npm)

    Details: Source: amazon-inspector (ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545) The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL, https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, on the mutable `main` branch. The parsed HTML is injected into the DOM and <script> nodes are re-created and appended to document.body, causing the remote JavaScript to execute in the consuming page's context. The reference is unpinned (no commit hash, tag, or integrity check), and the Bitbucket workspace (p2p-alt-public) is not aligned with any recognizable publisher. Whoever controls that branch can substitute arbitrary JavaScript at any time; each load of any application that imports this package will execute whatever bytes the branch currently serves, with the full privileges of that page.

    References: https://www.npmjs.com/package/3-buildsight-web/v/1.0.1, https://www.npmjs.com/package/3-buildsight-web/v/1.0.0

    Affected packages

    Package

    Name: 3-buildsight-web

    Purl: pkg:npm/3-buildsight-web

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0
    MAL-2026-14364 | CVE-DB