Critical Malicious Code Vulnerability in fabric-loader-core Package
Summary
MAL-2026-17306: Malicious code in fabric-loader-core (npm). Affects fabric-loader-core versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fabric-loader-core is an npm package designed as a native asset loader bridge for Fabric mod environments. It is intended to facilitate the integration of assets in Minecraft modding. However, this package has been found to contain a significant security vulnerability that allows for the execution of arbitrary code during installation, posing severe risks to users.
Vulnerability Detail
The vulnerability originates from the package's postinstall hook, which executes index.js. This script performs an HTTPS GET request to a hardcoded malicious server (https://fabric-npm.gm-service.xyz/p) and directly executes the response using vm.runInContext. This means that any code returned by the server runs with full Node.js privileges on the installer's machine. The implications of this vulnerability are severe, including potential credential theft, unauthorized persistence, and lateral movement within networks. The package's misleading name and purpose further complicate the issue, as it disguises its malicious intent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fabric-loader-coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the fabric-loader-core package until a secure version is available. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The fabric-loader-core package contains a critical vulnerability that allows for the execution of malicious code during installation. Users are advised to remove the package and monitor for updates. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for fabric-loader-core →
FAQ
The vulnerability allows malicious code to be executed on the user's machine during the installation of the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The risks include credential theft, unauthorized access, and potential control over the user's machine.
The best mitigation is to avoid using the fabric-loader-core package until a patched version is released.
Regularly check for updates in your package manager and consider using tools like Vulert for real-time monitoring.
