Credential Theft Vulnerability in fabric-native-loader Package
Summary
MAL-2026-17232: Malicious code in fabric-native-loader (npm). Affects fabric-native-loader versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fabric-native-loader is an npm package designed for loading fabric-related functionalities. However, it has been compromised to include malicious code that exploits user credentials. This vulnerability poses a significant risk to users, particularly those who utilize Minecraft-related applications, as it targets sensitive credential stores.
Vulnerability Detail
The vulnerability originates from a malicious postinstall hook defined in the package's package.json file. Upon installation, the hook executes index.js, which reads various Minecraft launcher credential stores, extracting sensitive tokens such as accessTokens and refreshTokens. Additionally, it scans the user's .minecraft directory for files containing sensitive information and sends this data to a hardcoded Discord webhook. The primary consequence of this vulnerability is credential theft, which can lead to unauthorized access to user accounts and potential misuse of their information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fabric-native-loaderIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the fabric-native-loader package altogether or use a different package that does not have known vulnerabilities. Additionally, monitoring your system for unauthorized access and changing your credentials can help mitigate potential risks.
Conclusion
The fabric-native-loader package contains a severe vulnerability that allows for credential theft through malicious code. Users are strongly advised to uninstall the package and monitor their systems for any unauthorized access. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities in real-time.
See every vulnerability recorded for fabric-native-loader →
FAQ
The fabric-native-loader is an npm package used for loading functionalities related to fabric, primarily in the context of Minecraft applications.
The vulnerability allows malicious code to extract sensitive credentials from users' systems, leading to potential unauthorized access to their accounts.
If you have installed the fabric-native-loader package, you should uninstall it immediately and update to a patched version if available.
Yes, you can use Vulert, which monitors and alerts you in real-time for open-source vulnerabilities using just your package-lock.json file. You can check your application for vulnerabilities without signing up at the Vulert playground.
Credential theft can lead to unauthorized access to user accounts, data breaches, and misuse of personal information, resulting in significant security risks.
