All undead NPCs have holy and silver. (Though like a PC there's nothing saying that in some cases they might not also have resistances/immunity stacked over that.)

Beyond that it's area writer discretion, and I mostly support that. For example, most of the undead in the Mausoleum have an extra vuln or two (which can be justified descriptionwise, etc. but that's another story), which I think balances nicely with it being probably the deadliest place you can go to get XP in the 20s.

If it's earmarked as a specific race (skeleton, ghoul, lich, etc) it will generally have the same resists and vulns.

Area authors can 'override' this, though, by adding the specific resist or vuln flag. So, to answer your question, in general: yes, they are hard coded, but they also vary by area.

Kastellyn the Devourer of Magic, Lord of Legends

*** Email me your testimonials or two-line blurbs. Help our marketing efforts! ***

Anyone ever considered making it consistent across areas?

Vuln_positive for general undead and vuln_blunt for skeletons seem pretty consistent. Can you say anything about which of the races (lich, ghoul, etc.), if any, are vuln silver and/or fire?

Mob standardization is a bigger project than item standardization, and I'm not even done with that. We've been doing it piecemeal as we revamp areas, and that's probably the rate at which you'll see it happen in the foreseeable future.

I don't think any of the 'standard' undead races are VULN_SILVER, and only mummys are VULN_FIRE.

Kastellyn the Devourer of Magic, Lord of Legends

*** Email me your testimonials or two-line blurbs. Help our marketing efforts! ***

Zombies were vuln silver and fire. Finding silver rapier on ground as newbie + graveyard = yay.