The 3-buildsight-web package's main entry point includes a top-level immediately-invoked function expression (IIFE) that, upon module load, fetches HTML content from a hardcoded Bitbucket raw URL on the mutable 'main' branch. The fetched HTML is parsed and injected into the DOM, with <script> elements recreated and appended to the document body, causing execution of remote JavaScript in the context of the consuming page. The reference to the remote code is unpinned, meaning it does not specify a commit hash, tag, or integrity check, allowing the remote content to be changed at any time by whoever controls the Bitbucket workspace 'p2p-alt-public'. This results in arbitrary code execution with the privileges of the page using the package.

Any application importing the affected versions of 3-buildsight-web will execute arbitrary JavaScript controlled by the attacker hosting the Bitbucket repository. This can lead to full compromise of the application's client-side environment, including data theft, session hijacking, or further malicious actions within the user's browser context.

No official patch or remediation is currently documented. Users should immediately stop using versions 1.0.0 and 1.0.1 of 3-buildsight-web. Avoid importing this package until a trusted, verified version is released. Consider auditing dependencies for similar unpinned remote code references. Monitor vendor advisories for updates or official fixes.