fabric-mod-utils

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (b3ada8fa4c11f57f6f8bfcf158b33b56d71f6f1433910b981cec70492b2272a9)
The package declares scripts.postinstall = 'node index.js'. On install, index.js performs an HTTPS GET to the hardcoded host fabric-npm.gm-service.xyz at path /p and passes the response body to vm.runInContext, executing whatever code the server returns on the installer's machine. The host and path are stored in short obfuscated variables (_h, _p). The package's stated purpose ('Native asset loader bridge for Fabric mod environments') is contradicted by its shipped contents: lib/renderer.js is an inert stub returning no-op { status: "ok" } shader results and has no relationship to the actual install-time behavior. The mod-utility framing functions as cover for an install-time remote-code loader whose payload is attacker-mutable and unpinned.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9b3ccbf4bfc4af3c2e53e9b0729d217beb12d481/osv/malicious/npm/fabric-mod-utils/MAL-2026-17307.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/9b3ccbf4bfc4af3c2e53e9b0729d217beb12d481/osv/malicious/npm/fabric-mod-utils/MAL-2026-17307.json
- https://www.npmjs.com/package/fabric-mod-utils/v/1.0.0
- https://github.com/advisories/GHSA-rf8p-xrcg-qxhh

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.