{"id":"MAL-2026-17232","revision":"e062cc50b4f546a2ab7e27f96dc0f5c6","records":[{"revision":"e062cc50b4f546a2ab7e27f96dc0f5c6","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17232","aliases":[],"title":"Malicious code in fabric-native-loader (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d289ae71736f05158f45d6636730641e82b5a774bf99bf1b587155d31c73daaa)\npackage.json declares a postinstall hook that runs index.js on npm install. index.js reads Minecraft launcher credential stores (launcher_accounts.json, launcher_profiles.json, and equivalent files for Prism, MultiMC, TLauncher, Modrinth, PolyMC, GDLauncher), extracting Mojang/Microsoft accessTokens, refreshTokens, and clientTokens. It also recursively walks the.minecraft directory reading.json/.txt/.cfg/.properties/.yml/.log files and matches their contents against JWT and Bearer-token regexes. The collected credentials are combined with os.hostname(), os.userInfo().username, and os.platform() and POSTed via HTTPS to a hardcoded Discord webhook (discord.com/api/webhooks/1554065488726990909/...). No functionality matching the package name is present; the sole effect of installing the package is credential theft against the installer.\n","state":0,"publishedAt":"2026-09-28T22:04:12+00:00","modifiedAt":"2026-09-28T22:30:05.539051+00:00","affected":[{"ecosystem":"npm","name":"fabric-native-loader","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/fabric-native-loader/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17232","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17232","identifiers":["MAL-2026-17232"]},"retained":false,"historicalAffected":[]}],"coverage":[]}