Credential Theft Vulnerability in fabric-render-bridge Package
Summary
MAL-2026-17225: Malicious code in fabric-render-bridge (npm). Affects fabric-render-bridge versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fabric-render-bridge package is an npm module designed to facilitate rendering functionalities for Minecraft-related applications. However, it has been identified as malicious, containing code that executes during installation, compromising user credentials and system information. This vulnerability poses a significant risk to users who install the package, as it does not provide any legitimate functionality related to rendering.
Vulnerability Detail
The vulnerability originates from the package's post-install script, which automatically executes index.js upon installation. This script reads sensitive Minecraft launcher credential stores and session dumps from the operating system's temporary directory. It extracts access tokens, refresh tokens, and usernames, then sends this information to a hardcoded Discord webhook. Additionally, it transmits system information such as the hostname and username on every installation, leading to potential identity theft and unauthorized access to user accounts.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fabric-render-bridgeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid installing the fabric-render-bridge package until a secure version is released. You can also use alternative packages that provide similar functionality without the associated risks.
Conclusion
The fabric-render-bridge package contains a serious vulnerability that compromises user credentials and system information. It is essential to uninstall the package immediately and seek alternatives to protect your data. Regular monitoring of your dependencies with tools like Vulert can help prevent similar issues in the future.
See every vulnerability recorded for fabric-render-bridge →
FAQ
fabric-render-bridge is an npm package intended for rendering functionalities in Minecraft-related applications, but it has been identified as malicious.
The vulnerability executes a script during installation that steals user credentials and system information, sending it to a Discord webhook.
Uninstall the package immediately using 'npm uninstall fabric-render-bridge' and check for any compromised accounts.
Yes, consider using other npm packages that provide similar functionalities without the security risks.
Vulert monitors and alerts for open-source vulnerabilities in your software using just package-lock.json, allowing you to stay informed about potential risks.
