CVE-2025-54313: Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

Published Jul 19, 2025
·
Updated

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Other sources

Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

— CISA

Affected Software

29 affected componentsFixes available
ESLint eslint-config-prettier>=8.10.1<10.1.8
npm/got-fetch>=5.1.11<=5.1.12
6.0.0
npm/napi-postinstall=0.3.1
0.3.2
npm/@pkgr/core=0.2.8
0.2.9
npm/synckit=0.11.9
0.11.10
npm/eslint-plugin-prettier>=4.2.2<=4.2.3
4.2.4
npm/eslint-config-prettier>=10.1.6<=10.1.7
10.1.8
npm/eslint-config-prettier=9.1.1
9.1.2
npm/eslint-config-prettier=8.10.1
8.10.2
Prettier eslint-config-prettier
All of the following
Any of the following
Prettier Eslint-config-prettier Node.js=8.10.1
Prettier Eslint-config-prettier Node.js=9.1.1
Prettier Eslint-config-prettier Node.js=10.1.6
Prettier Eslint-config-prettier Node.js=10.1.7
Microsoft Windows
All of the following
Any of the following
Prettier Eslint-plugin-prettier Node.js=4.2.2
Prettier Eslint-plugin-prettier Node.js=4.2.3
Microsoft Windows
All of the following
Un-ts Synckit Node.js=0.11.9
Microsoft Windows
All of the following
Un-ts Pkgr\/core Node.js=0.2.8
Microsoft Windows
All of the following
Any of the following
Alexghr Got-fetch Node.js=5.1.1
Alexghr Got-fetch Node.js=5.1.2
Microsoft Windows
All of the following
Un-ts Napi-postinstall Node.js=0.3.1
Microsoft Windows
All of the following
Homarr Homarr>=1.29.0<1.30.0
Microsoft Windows

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/got-fetch to a version that resolves this vulnerability.

    Fixed in 6.0.0
  2. Upgrade

    Upgrade npm/napi-postinstall to a version that resolves this vulnerability.

    Fixed in 0.3.2
  3. Upgrade

    Upgrade npm/@pkgr/core to a version that resolves this vulnerability.

    Fixed in 0.2.9
  4. Upgrade

    Upgrade npm/synckit to a version that resolves this vulnerability.

    Fixed in 0.11.10
  5. Upgrade

    Upgrade npm/eslint-plugin-prettier to a version that resolves this vulnerability.

    Fixed in 4.2.4
  6. Upgrade

    Upgrade npm/eslint-config-prettier to a version that resolves this vulnerability.

    Fixed in 10.1.8
  7. Upgrade

    Upgrade npm/eslint-config-prettier to a version that resolves this vulnerability.

    Fixed in 9.1.2
  8. Upgrade

    Upgrade npm/eslint-config-prettier to a version that resolves this vulnerability.

    Fixed in 8.10.2
  9. Compensating control

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Event History

Jul 19, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:30 PM
Data Sourced
via GitHub·06:30 PM
DescriptionSeverityWeaknessAffected Software
Nov 3, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Jan 22, 2026
Known Exploited
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionAffected Software
Jan 23, 2026
News Published
via BleepingComputer·06:47 PM
News Published
via BleepingComputer·06:48 PM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-54313?

CVE-2025-54313 is classified as a critical vulnerability due to the execution of malware upon installation.

2

How do I fix CVE-2025-54313?

To fix CVE-2025-54313, you should update to a version of eslint-config-prettier that is beyond 10.1.8.

3

What versions are affected by CVE-2025-54313?

CVE-2025-54313 affects versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 of eslint-config-prettier.

4

What type of malware is involved in CVE-2025-54313?

CVE-2025-54313 involves the installation of node-gyp.dll malware on Windows systems.

5

How was the CVE-2025-54313 vulnerability introduced?

CVE-2025-54313 was introduced through a supply chain compromise where malicious code was embedded in the package.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2025-54313 - Prettier eslint-config-prettier Embedded Malicious Code Vulnerability - SecAlerts