0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
websight-p2p
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting websight-p2p, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-10697 | Unknown | Malicious code in websight-p2p (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78) The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p) and passes the response to document.write(), executing whatever HTML/JavaScript the worker returns. There is no integrity check, no version pinning, and the worker can serve different content per request or per caller. There are no npm lifecycle hooks, so installing the package does not execute code on the developer's ma |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78) The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p) and passes the response to document.write(), executing whatever HTML/JavaScript the worker returns. There is no integrity check, no version pinning, and the worker can serve different content per request or per caller. There are no npm lifecycle hooks, so installing the package does not execute code on the developer's ma