Malicious Code Detected in com.unity.shadergraph - Security Alert
Summary
MAL-2025-17363: Malicious code in com.unity.shadergraph (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package com.unity.shadergraph is a widely used library in the npm ecosystem, primarily utilized for creating and managing shaders in Unity applications. It offers developers tools to enhance graphics rendering and visual effects. However, recent findings have uncovered a serious security vulnerability within this package, exposing users to potential risks.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the com.unity.shadergraph package. This code can lead to unauthorized access, data breaches, or other harmful actions within applications that utilize this package. The issue was introduced in version 0 and has been identified as a significant threat to developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall com.unity.shadergraphIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the com.unity.shadergraph package from your project until a secure version is released. You can do this using the command: npm uninstall com.unity.shadergraph.
Conclusion
The discovery of malicious code in the com.unity.shadergraph package poses a significant threat to developers and users. Immediate action is required to mitigate risks, including updating or removing the package. Stay informed about updates and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for com.unity.shadergraph →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data or lead to other harmful actions within applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider removing the package as a temporary measure to mitigate risks.
Currently, the vulnerability affects all versions starting from 0. It is essential to monitor the official repository for updates on a secure version.
Ignoring this vulnerability could lead to severe security breaches, data loss, or unauthorized access to your applications and user data.
