registry / fabric-mod-utils / 1.0.0

fabric-mod-utils@1.0.0

OSV Malicious Advisory

imported 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17307 confirms this npm version as malicious. The package declares scripts.postinstall = 'node index.js'. On install, index.js performs an HTTPS GET to the hardcoded host fabric-npm.gm-service.xyz at path /p and passes the response body to vm.runInContext, executing whatever code the server returns on the installer's machine. The host and path are stored in short obfuscated variables (_h, _p)...

Advisory

MAL-2026-17307

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in fabric-mod-utils (npm)

Details

The package declares scripts.postinstall = 'node index.js'. On install, index.js performs an HTTPS GET to the hardcoded host fabric-npm.gm-service.xyz at path /p and passes the response body to vm.runInContext, executing whatever code the server returns on the installer's machine. The host and path are stored in short obfuscated variables (_h, _p). The package's stated purpose ('Native asset loader bridge for Fabric mod environments') is contradicted by its shipped contents: lib/renderer.js is an inert stub returning no-op { status: "ok" } shader results and has no relationship to the actual install-time behavior. The mod-utility framing functions as cover for an install-time remote-code loader whose payload is attacker-mutable and unpinned.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EvalNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 789 B of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const https = require("https"); L2: const vm = require("vm"); ... L8: try { L9: const ctx = vm.createContext({ require, process, Buffer, setTimeout, clearTimeout, setInterval, clearInterval, console, __filename, __dirname, URL }); L10: vm.runInContext(code, ctx);

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

index.jsView on unpkg · L1

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumUnsafe Vm Contextindex.js

MediumNetwork

LowScripts Present

LowEval

Affected versions and remediation

This report applies to fabric-mod-utils@1.0.0.

See version security history for other recorded verdicts.

Avoid installing fabric-mod-utils@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 01:45:10.589Z (UTC).

Source advisory published: 2026-09-30 01:26:57.000Z (UTC).