The 6-viewsight-web npm package's main module is a self-executing function that retrieves HTML content from a Bitbucket repository URL pointing to the mutable 'main' branch. It injects this HTML into the page's DOM and recreates each <script> element to execute the embedded JavaScript in the application's context. Because the URL is not pinned to a specific version, hash, or signature, an attacker controlling the Bitbucket repository can modify the payload at any time, causing arbitrary code execution in all applications that load this package. The package.json lacks author metadata and has a generic description, with no verified relationship between the npm publisher and the Bitbucket repository owner.

Any application that includes the 6-viewsight-web package versions 1.0.0 or 1.0.1 is at risk of executing arbitrary and potentially malicious code controlled by whoever manages the referenced Bitbucket repository. This can lead to compromise of the application's security, data leakage, or further exploitation depending on the injected payload. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently available for this package. Users should immediately remove or replace the 6-viewsight-web package versions 1.0.0 and 1.0.1 from their projects to prevent execution of untrusted remote code. Avoid using packages that fetch and execute remote content without integrity checks. Monitor vendor advisories or npm for any updates or safer alternatives.