The fabric-asset-pipeline npm package versions 1.0.0 and 1.0.1 include a postinstall hook that runs obfuscated JavaScript code (index.js) upon installation. This code implements functions to steal Minecraft credentials from official and third-party launchers by reading files like launcher_accounts.json and launcher_profiles.json, as well as session dumps from the OS temporary directory. The stolen credentials and system information are sent via HTTPS POST requests to a webhook URL that is decoded at runtime using RC4. The obfuscation techniques include rotated string arrays, base64 and RC4 decoding, and anti-formatting measures to conceal the malicious intent and exfiltration endpoints. This behavior is unrelated to the package's stated purpose as an asset loader bridge.

Attackers can obtain Minecraft account credentials, including access and refresh tokens, from infected systems. This compromises user accounts across multiple Minecraft launchers, potentially allowing unauthorized access and account takeover. Additionally, system information is leaked, which could aid further targeted attacks. The malicious code executes automatically during package installation, increasing the risk of widespread compromise among users who install this package.

No official patch or remediation is currently documented. Users should avoid installing fabric-asset-pipeline versions 1.0.0 and 1.0.1. If already installed, remove the package and scan systems for signs of compromise. Monitor for suspicious network connections to unknown webhooks. Since no vendor advisory or patch information is available, check the package repository or npm advisories for updates or removal notices. Consider using trusted package sources and verifying package integrity before installation.