OpenSSF/OSV advisory MAL-2026-14365 confirms this npm version as malicious. The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and injects it into the consuming page's DOM, re-creating each <script> element so its contents execute in the page's JavaScript context...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in 6-viewsight-web (npm)
Details
The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and injects it into the consuming page's DOM, re-creating each <script> element so its contents execute in the page's JavaScript context. The URL points at the mutable `main` branch with no version pin, hash, or signature check, so whoever controls the `p2p-alt-public/p2p-emis` Bitbucket repository can change the payload at any time and have it run in every application that loads this package. package.json ships with empty author metadata, MIT default, and a generic 'Website loader for remote HTML content' description, and there is no relationship between the publishing npm identity and the Bitbucket account hosting the fetched code.
Decision reason
OpenSSF Malicious Packages via OSV confirms 6-viewsight-web@1.0.1 as malicious (MAL-2026-14365): Malicious code in 6-viewsight-web (npm)