Critical Malicious Code Vulnerability in fabric-asset-pipeline Package
Summary
MAL-2026-17224: Malicious code in fabric-asset-pipeline (npm). Affects fabric-asset-pipeline versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fabric-asset-pipeline is an npm package designed to serve as an asset loader bridge for web applications. It is intended to streamline the management of assets such as images, stylesheets, and scripts. However, a serious vulnerability has been discovered in version 1.0.0, where malicious code is executed during the installation process, compromising user security.
Vulnerability Detail
The vulnerability originates from a postinstall hook in the fabric-asset-pipeline package that executes an obfuscated index.js file. This file contains malicious functions that steal Minecraft account credentials from various sources, including the official Minecraft launcher and other third-party launchers. The stolen data, including usernames and access tokens, is sent to a hardcoded external server via HTTP POST requests. The obfuscation techniques used make it difficult to detect the malicious behavior, posing a significant risk to users who install this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fabric-asset-pipelineIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the fabric-asset-pipeline package until you can ensure that you are using a safe version. Additionally, consider using alternative asset management packages that do not have known vulnerabilities.
Conclusion
The fabric-asset-pipeline package has a critical vulnerability that allows malicious code to steal sensitive information. Users are strongly advised to update to the latest version and monitor their dependencies to prevent future risks.
See every vulnerability recorded for fabric-asset-pipeline →
FAQ
The malicious code is designed to steal Minecraft account credentials and send them to an external server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your package-lock.json file to check for vulnerabilities.
Immediately update to the patched version (1.0.1) using the command 'npm install fabric-asset-pipeline@1.0.1' to mitigate the risk.
Regularly monitor your dependencies using tools like Vulert and keep them updated to the latest secure versions.
Failure to address this vulnerability may lead to unauthorized access to your Minecraft accounts and potential data breaches.
