Malicious code in 6-viewsight-web (npm)
The npm package 6-viewsight-web contains malicious code that fetches and injects HTML from a remote Bitbucket repository into consuming applications' DOM, allowing arbitrary code execution. The fetched content is pulled from an unpinned, mutable branch with no integrity verification, enabling the attacker to change the payload at any time.
- Disclosed
- Last updated
- Blast radius
- Any application consuming the 6-viewsight-web npm package would execute arbitrary HTML/JavaScript injected from a remote Bitbucket repository controlled by the attacker.
- Ecosystems
- Attack vectors
- Affected entities
- 6-viewsight-webnpm package with malicious code in main module
The npm package 6-viewsight-web was published with a self-executing IIFE (Immediately Invoked Function Expression) in its main module that fetches HTML content from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight. This content is then injected into the consuming application's DOM by recreating each element, causing the injected code to execute in the page's JavaScript context.
The attack is particularly dangerous because the URL points to the mutable main branch of the Bitbucket repository with no version pinning, cryptographic hash verification, or signature checking. This means whoever controls the p2p-alt-public/p2p-emis Bitbucket repository can modify the payload at any time, and all applications that have loaded this package will execute the updated malicious code.
The package metadata shows no legitimate relationship between the npm publisher and the Bitbucket account hosting the fetched code. The package.json contains empty author metadata, a generic MIT license, and a vague description of "Website loader for remote HTML content," suggesting intentional obfuscation of its true purpose.
This incident was identified by the OpenSSF's malicious-packages project and assigned identifier MAL-2026-14365.
Indicators of compromise
- Packages
- 6-viewsight-web
- Domains
- bitbucket.org
Remediation
- Immediately remove 6-viewsight-web from all dependencies and applications
- Audit all applications that may have installed this package for signs of compromise or data exfiltration
- Review npm audit logs and package-lock.json files to identify when and where this package was installed
- Consider the security of any systems that executed code from applications using this package
- Report the package to npm for removal and account investigation
- Monitor for similar packages with generic descriptions and no clear author attribution
Sources
- GitHub Advisory GHSA-g8jq-29p5-5qrp · GitHub Advisory Database
Cite this entry
"Malicious code in 6-viewsight-web (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-6-viewsight-web-npm-8bc88d
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package