websight2-p2p@1.0.1

websight2-p2p exposes a single function, loadWebSight(), whose entire behavior is to fetch https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight from a mutable 'main' branch (no version pin, no commit hash, no integrity check) and inject the response body directly into a newly-opened browser window via document.write(html). Whatever HTML/JavaScript the Bitbucket repository serves at the moment of the call is executed in the caller's browser context. Any future change to the Bitbucket repo — by the maintainer or by anyone who gains access to it — silently runs in every consumer's browser. The package's advertised public API is the remote-code dropper; consumers who use it as documented are executing unverified third-party code on every invocation. ## Source: ghsa-malware (e0f4f7e738f3c8d0c67360c47bcd6bcbb6e66c15539d05ff1c5db4133b402b98) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.