CVE-2025-54313
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
Description
CVE-2025-54313 is a high-severity supply chain compromise affecting eslint-config-prettier, a widely used npm package maintained under the Prettier organization. Specific malicious versions (8.10.1, 9.1.1, 10.1.6, and 10.1.7) contain embedded malware that executes during package installation, launching the node-gyp.dll payload on Windows systems. With a CVSS v3.1 base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N), the vulnerability has a changed scope, indicating impact beyond the compromised package. The compromise extends to multiple related npm packages including eslint-plugin-prettier, @anthropic-ai/sdk-like packages, and others. It is listed in CISA's KEV catalog with a remediation deadline of February 12, 2026, and has an EPSS score of 0.07771 (91.8th percentile). CISA lists the ransomware association as "Unknown."
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| prettier | eslint-config-prettier | 8.10.1; 9.1.1; 10.1.6; 10.1.7 |
| prettier | eslint-plugin-prettier | 4.2.2; 4.2.3 |
| un-ts | synckit | 0.11.9 |
| un-ts | pkgr\/core | 0.2.8 |
| alexghr | got-fetch | 5.1.1; 5.1.2 |
| un-ts | napi-postinstall | 0.3.1 |
| homarr | homarr | >= 1.29.0, < 1.30.0 |
References
- https://github.com/prettier/eslint-config-prettier/issues/339(Issue Tracking)
- https://news.ycombinator.com/item?id=44608811(Issue Tracking)
- https://news.ycombinator.com/item?id=44609732(Issue Tracking)
- https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise(Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/(Exploit, Third Party Advisory)
- https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions(Product)
- https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise(Exploit, Third Party Advisory)
- https://github.com/community-scripts/ProxmoxVE/discussions/6115(Third Party Advisory)
- https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313(US Government Resource)
Weakness Type
CWE-506: Embedded Malicious Code
CVE-2025-54313 is classified under CWE-506, which describes software that contains code that appears to be malicious in nature and was intentionally inserted by a threat actor. In this case, the compromised npm package versions contain an install.js file that executes automatically during the npm install process. This script downloads and launches the node-gyp.dll malware payload on Windows systems. The malicious code was not part of the original legitimate package but was injected after the package maintainer accounts were compromised through a phishing campaign targeting npm package maintainers. Learn more about CWE-506
Impact Analysis
Supply Chain Malware Distribution is the primary impact of CVE-2025-54313. The compromised npm packages are dependencies in countless JavaScript and TypeScript projects. Any developer or CI/CD system that installs the affected versions on a Windows machine automatically executes the embedded malware without any visible indication of compromise.
Confidentiality Impact is low (C:L) but with changed scope (S:C). The malware payload (node-gyp.dll) can exfiltrate data from the compromised system, but the immediate confidentiality impact per the CVSS rating is limited. However, the changed scope indicates that the compromise extends beyond the npm package itself to affect the broader system, other projects, and potentially the software supply chain downstream of the compromised developer.
Integrity Impact is high (I:H). The malware fundamentally compromises the integrity of the software build environment. Any software built on a system where the malware executed cannot be trusted, as the malware may have modified build outputs, injected additional malicious code into compiled artifacts, or altered the development toolchain. The integrity of the npm package ecosystem itself is undermined because the compromise was achieved through account takeover of trusted maintainers.
Availability Impact is none (A:N) as rated in the CVSS vector, though the practical impact of responding to a supply chain compromise (auditing systems, rebuilding from clean environments, rotating credentials) creates significant operational disruption.
Scope of Compromise: The attack extends beyond eslint-config-prettier to multiple packages including eslint-plugin-prettier (4.2.2, 4.2.3), @anthropic-ai packages, synckit (0.11.9), @pkgr/core (0.2.8), got-fetch (5.1.1, 5.1.2), napi-postinstall (0.3.1), and homarr (1.29.0 through 1.30.0). The breadth of compromised packages indicates a coordinated campaign. The EPSS score of 0.07771 (91.8th percentile) reflects widespread exploitation through package installation.
Exploit Maturity
CVE-2025-54313 represents a confirmed, active supply chain attack that has been executed in the wild. The malicious packages were published to the npm registry and installed by an unknown number of developers and build systems before the compromise was detected.
Attack Mechanism: The compromise was achieved through a phishing campaign targeting npm package maintainers, as documented by Socket.dev and BleepingComputer. The attackers obtained maintainer credentials and used them to publish trojanized versions of the legitimate packages. The malicious versions contain an install.js script that runs automatically during npm install and downloads the node-gyp.dll malware on Windows systems.
Widespread Distribution: eslint-config-prettier is one of the most widely used ESLint configuration packages, with millions of weekly downloads. The compromised versions were published to the official npm registry and distributed through the normal package installation process, making detection extremely difficult for end users.
Detection and Response: The compromise was discovered and reported through multiple channels, including a GitHub issue on the eslint-config-prettier repository and discussions on Hacker News. StepSecurity published a detailed analysis of the compromise. The affected versions have been removed from npm, but any system that installed them during the compromise window may be affected.
Ransomware Association: CISA lists the ransomware association as "Unknown." The node-gyp.dll payload's full capabilities have not been publicly disclosed in complete detail, and it may serve as a loader for additional malware including ransomware.
Remediation
-
Audit your project dependencies immediately to determine if any compromised package versions are installed. Check for eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, or 10.1.7, and the other affected packages listed in the advisory. Run
npm ls eslint-config-prettierandnpm ls eslint-plugin-prettierto identify installed versions. Also check lock files (package-lock.json or yarn.lock) for the specific compromised versions. -
Remove and reinstall affected packages using clean, verified versions. Delete the node_modules directory and lock file, then reinstall with
npm install. The compromised versions have been removed from npm, so a fresh install will pull safe versions. Verify the installed versions after reinstallation to confirm they do not match the compromised version numbers. -
Scan Windows systems that installed affected packages for the node-gyp.dll malware. Search for the node-gyp.dll file in temporary directories and user profile locations. Run a full antivirus scan with updated definitions. If the malware is found, treat the system as fully compromised and follow your organization's incident response procedures, including reimaging the system from a known-clean state.
-
Rotate all credentials and secrets accessible from any system where the compromised packages were installed. This includes npm tokens, Git credentials, SSH keys, cloud provider API keys, database passwords, and any other secrets stored in environment variables, configuration files, or credential managers on the affected system. The malware may have exfiltrated these credentials.
-
Implement npm security measures to prevent future supply chain attacks. Enable npm audit in CI/CD pipelines, use lockfile verification to detect unexpected version changes, configure npm to require two-factor authentication for publishing, and consider using a private registry or registry proxy that filters packages through security scanning. Tools like Socket.dev and Snyk can provide real-time monitoring for supply chain compromises in your dependencies.
Technical Details
CVE-2025-54313 is a supply chain compromise affecting the eslint-config-prettier npm package and several related packages. The attack was executed through a phishing campaign that compromised package maintainer accounts, allowing the attackers to publish trojanized versions to the npm registry.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N yields a score of 7.5. The attack vector is network-based (AV:N) because the malicious packages are distributed through the npm registry over the internet. Attack complexity is high (AC:H) because the victim must install a specific compromised version during the window when the malicious versions were available. No privileges (PR:N) or user interaction (UI:N) are needed because package installation is an automated process. The scope is changed (S:C) because the compromise extends beyond the npm package to affect the operating system, build environment, and downstream software. Integrity impact is high (I:H) due to the fundamental compromise of the software supply chain.
Malware Delivery Mechanism: The compromised package versions include a modified install.js file that npm's lifecycle script system executes automatically during npm install. This is a legitimate npm feature designed for native module compilation, but the attackers abused it to execute malicious code. The install.js script checks if the host system is running Windows and, if so, downloads and executes the node-gyp.dll payload. The filename "node-gyp.dll" was chosen to mimic the legitimate node-gyp native addon build tool, providing camouflage in process listings and file system audits.
Compromised Package Versions: The attack affected specific versions of multiple packages: eslint-config-prettier (8.10.1, 9.1.1, 10.1.6, 10.1.7), eslint-plugin-prettier (4.2.2, 4.2.3), synckit (0.11.9), @pkgr/core (0.2.8), got-fetch (5.1.1, 5.1.2), napi-postinstall (0.3.1), and homarr (1.29.0 through 1.30.0). The variety of packages suggests the phishing campaign successfully compromised multiple maintainer accounts.
Phishing Campaign: The attack originated from a targeted phishing campaign against npm package maintainers. The phishing messages impersonated npm or GitHub communications and tricked maintainers into entering their credentials on fake login pages. With the stolen credentials, the attackers gained publishing access to the legitimate packages and uploaded the trojanized versions. This is a common pattern in npm supply chain attacks that exploits the trust relationship between the package registry and package consumers.
Frequently Asked Questions
What is CVE-2025-54313?
CVE-2025-54313 is a supply chain compromise where specific versions of eslint-config-prettier and related npm packages were trojanized with embedded malware. The compromised versions (8.10.1, 9.1.1, 10.1.6, 10.1.7) contain an install.js script that automatically downloads and executes the node-gyp.dll malware on Windows systems during package installation.
How were the packages compromised?
The attackers executed a phishing campaign targeting npm package maintainers, stealing their credentials and gaining publishing access to the legitimate packages. They then uploaded trojanized versions containing the malware payload. The attack exploited npm's lifecycle script feature that allows packages to run code during installation.
Am I affected if I use macOS or Linux?
The node-gyp.dll malware payload specifically targets Windows systems, so the executable payload does not run on macOS or Linux. However, if you installed a compromised package version, the malicious install.js script was still executed on your system. While the primary payload is Windows-specific, it is prudent to treat any system that ran the compromised installer as potentially affected and to rotate credentials as a precaution.
What should I do if I installed a compromised version?
First, check your package-lock.json or yarn.lock for the specific compromised versions. If found, delete node_modules and the lock file, then reinstall dependencies. On Windows systems, scan for node-gyp.dll and run a full antivirus scan. Rotate all credentials accessible from the affected system, including npm tokens, SSH keys, and cloud API keys. If the malware was executed, consider reimaging the system from a clean backup.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.