Malicious Code Detected in com.microsoft.mrtk.graphicstools.shadergraph.unity: Security Risk Alert
Summary
MAL-2025-6918: Malicious code in com.microsoft.mrtk.graphicstools.shadergraph.unity (npm). Affects com.microsoft.mrtk.graphicstools.shadergraph.unity versions >= 1.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'com.microsoft.mrtk.graphicstools.shadergraph.unity' is part of the Microsoft Mixed Reality Toolkit (MRTK), designed to facilitate the development of mixed reality applications in Unity. This package provides tools for shader graph manipulation, enhancing graphical capabilities for developers. However, it has been identified to communicate with a domain associated with malicious activities, raising significant security concerns.
Vulnerability Detail
The vulnerability stems from the package's ability to communicate with a potentially harmful domain, which could lead to unauthorized data access or manipulation. This malicious activity poses a risk to applications utilizing this package, as it may compromise user data and application integrity. The issue was introduced in version 1.9.9, and it is critical for developers to be aware of the implications of using this version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall com.microsoft.mrtk.graphicstools.shadergraph.unityIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the package from your project until a secure version is released. You can do this by running the following command: npm uninstall com.microsoft.mrtk.graphicstools.shadergraph.unity. This will help mitigate the risk while you await a fix.
Conclusion
The identification of malicious code in the 'com.microsoft.mrtk.graphicstools.shadergraph.unity' package highlights the importance of maintaining secure coding practices and regularly updating dependencies. Developers are urged to take immediate action to mitigate risks associated with this vulnerability.
See every vulnerability recorded for com.microsoft.mrtk.graphicstools.shadergraph.unity →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, which can compromise application security.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider removing the package from your project to prevent potential security risks.
Check the package repository for the latest version available and update to that version to ensure you have the latest security patches.
Vulert uses your package-lock.json file to monitor and alert you in real-time about open-source vulnerabilities, providing an easy way to stay informed.
