eslint-config-prettier Supply Chain Compromise and Malware Execution Vulnerability (CVE-2025-54313)
Executive & SecOps Summary
SECOPS ASSESSMENTWindows development and build environments utilizing eslint-config-prettier package versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7
Installation of the compromised package triggers automatic execution of install.js, dropping and executing the node-gyp.dll malware to compromise the host system
Immediately uninstall the compromised versions, force-downgrade or upgrade to a clean version, and scan systems for malicious DLL files
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Audit your project's package.json and lock files to remove the compromised versions and install a verified safe version.
# For npm users: Uninstall compromised versions and install safe version
npm uninstall eslint-config-prettier
npm install eslint-config-prettier@10.1.5 --save-dev
# For yarn users:
yarn remove eslint-config-prettier
yarn add eslint-config-prettier@10.1.5 --dev2. Temporary Workaround & Hardening Configuration
To prevent untrusted packages from executing arbitrary code during installation, disable npm lifecycle scripts globally or per command.
# Disable script execution globally in npm configuration
npm config set ignore-scripts true
# Run install with script execution disabled
npm install --ignore-scripts3. Log Audit & IoC Verification Commands
Use the following PowerShell script to detect compromised package versions and scan for the presence of the malicious 'node-gyp.dll' file on Windows systems.
# 1. Scan local projects for compromised eslint-config-prettier versions
Get-ChildItem -Path . -Filter 'package.json' -Recurse | ForEach-Object {
$content = Get-Content $_.FullName | ConvertFrom-Json
if ($content.dependencies.'eslint-config-prettier' -or $content.devDependencies.'eslint-config-prettier') {
Write-Host 'Found package.json in:' $_.DirectoryName
npm list eslint-config-prettier
}
}
# 2. Scan the system for the malicious node-gyp.dll file
Get-ChildItem -Path C:\ -Filter 'node-gyp.dll' -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
Write-Warning 'Malicious node-gyp.dll detected at: ' + $_.FullName
}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-54313) represents a supply chain compromise targeting the widely used 'eslint-config-prettier' npm package. Attackers compromised the package distribution pipeline (likely via phishing) and published malicious versions containing embedded unauthorized code (CWE-506) directly to the public npm registry.
2. Exploitation Mechanics & Attack Scenario
When a developer or a CI/CD pipeline installs one of the affected versions (8.10.1, 9.1.1, 10.1.6, 10.1.7), npm's lifecycle scripts automatically execute the embedded 'install.js' file. On Windows operating systems, this script drops and executes a malicious dynamic link library named 'node-gyp.dll', masquerading as a legitimate Node.js build tool to establish persistence or execute arbitrary payloads.
3. Infrastructure & Business Impact
Given its inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild. If Windows-based developer workstations or CI/CD build runners (e.g., Jenkins, GitHub Actions runners) install these compromised packages, attackers can gain full system-level access. This can lead to intellectual property theft, credential harvesting (AWS keys, API tokens), and lateral movement within corporate networks.
Official Vendor Advisories & References
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Frequently Asked SecOps Questions (CVE-2025-54313)
FAQQ1. How critical is CVE-2025-54313 and is it actively exploited in the wild?
CVE-2025-54313 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 5.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-54313?
Primary impacted vendors include prettier across eslint-config-prettier. Scope summary: eslint-config-prettier package versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 (on Windows platforms)
Q3. What temporary mitigations or workarounds exist for CVE-2025-54313 before patching?
[Mitigation] Immediately uninstall the compromised versions, force-downgrade or upgrade to a clean version, and scan systems for malicious DLL files Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-54313
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (prettier)
View Category →Aqua Security Trivy Supply Chain Attack and Malicious Release (CVE-2026-33634) Critical Security Advisory
[Affected Scope] Trivy Go/Container image v0.69.4, trivy-action v0.0.1 to v0.34.2 (76 tags), setup-trivy v0.2.0 to v0.2.6
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.