The pxpure8 npm package (version 1.0.2) includes a main script that injects a <script> element pointing to https://cdn.jsdelivr.net/npm/px8my/px.js without version pinning. This causes arbitrary JavaScript from the unrelated px8my package to execute in the context of any browser-like environment that imports pxpure8. The unpinned dependency allows the px8my package owner to change the executed code at any time, potentially introducing malicious behavior. The lack of author information, description, repository, and meaningful metadata suggests pxpure8 is a malicious package intended to load remote code dynamically, posing a supply chain threat to applications that include it.

Applications that include or bundle pxpure8 version 1.0.2 will execute arbitrary JavaScript controlled by the px8my package owner in their runtime environment. This can lead to compromise of the application's integrity, data leakage, or further malicious activity depending on the code served by px8my. Because the loaded code is unpinned, the risk persists indefinitely and can escalate if px8my publishes malicious updates.

No official patch or remediation is currently available. Users should immediately remove pxpure8 version 1.0.2 from their dependencies and avoid including it in any builds or deployments. Since the package dynamically loads untrusted remote code, it should be considered malicious and untrusted. Monitor vendor advisories for any updates or official guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.