The 8-fetchsight-web npm package includes a top-level Immediately Invoked Function Expression (IIFE) in index.js and index.html that fetches HTML content from a Bitbucket URL pinned to the mutable 'main' branch of an unrelated workspace. The fetched HTML replaces the current document and re-creates all <script> tags, causing both inline and remote scripts from the fetched document to execute in the page context. Because the Bitbucket path is mutable and not controlled by the npm package publisher, an attacker with control over that Bitbucket repository can substitute arbitrary JavaScript at any time, resulting in arbitrary code execution in all pages loading this package. There are no integrity checks or source pinning mechanisms to prevent this.

Any user loading the affected versions of the 8-fetchsight-web package may execute arbitrary JavaScript controlled by an attacker who can modify the Bitbucket repository content. This can lead to full compromise of the web page context, including data theft, session hijacking, or further client-side attacks. The vulnerability arises from the package's design that blindly executes remote code without validation.

No official patch or remediation is currently documented. Users should avoid using versions 1.0.0 and 1.0.1 of 8-fetchsight-web. Until a fix is available, do not load this package from untrusted sources. Monitor the vendor or repository for updates or advisories addressing this issue. Consider removing or replacing this package with alternatives that do not execute remote code without integrity verification.