The 10-shardsight-web npm package includes a top-level asynchronous script that fetches HTML content from a hardcoded URL on a mutable Bitbucket repository unrelated to the declared publisher. It replaces the document's head and body with this fetched content and re-creates all <script> tags, causing the remote JavaScript to execute within the consumer's page context. Because the remote repository is mutable and not pinned to a specific commit or version, an attacker controlling that repository can push arbitrary JavaScript code that will run in any application using this package, effectively enabling remote code execution.

Any application that installs and runs 10-shardsight-web versions 1.0.0 or 1.0.1 is at risk of executing arbitrary JavaScript code controlled by an attacker. This can lead to compromise of the application's integrity, data leakage, or further exploitation depending on the application context. The risk arises from the package's reliance on a mutable, untrusted remote source without integrity verification.

No official patch or remediation is currently documented. Users should immediately avoid using versions 1.0.0 and 1.0.1 of 10-shardsight-web. Remove the package from projects and replace it with a trusted alternative. Monitor for updates from the package maintainer or vendor advisory for any official fixes. Until a fix is available, do not use this package in any environment.