CVE-2025-54313
📋 TL;DR
This CVE describes a supply chain compromise where malicious versions of eslint-config-prettier contain embedded malware. Installing affected package versions triggers execution of node-gyp.dll malware on Windows systems. Developers and organizations using these specific package versions in their Node.js projects are affected.
💻 Affected Systems
- eslint-config-prettier
📦 What is this software?
Got Fetch by Alexghr
Got Fetch by Alexghr
Homarr by Homarr
Synckit by Un Ts
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with malware establishing persistence, data exfiltration, and lateral movement within the network.
Likely Case
Malware installation leading to system compromise, potential credential theft, and unauthorized access to development environments.
If Mitigated
Limited impact if detected early with malware removal and system restoration from clean backups.
🎯 Exploit Status
Exploitation occurs automatically upon package installation via npm install or similar commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions other than 8.10.1, 9.1.1, 10.1.6, 10.1.7
Vendor Advisory: https://github.com/prettier/eslint-config-prettier/issues/339
Restart Required: No
Instructions:
1. Remove affected package versions: npm uninstall eslint-config-prettier
2. Install clean version: npm install eslint-config-prettier@latest
3. Verify package.json uses safe version
4. Run npm audit to confirm no vulnerabilities
🔧 Temporary Workarounds
Pin to safe version
allExplicitly specify a safe version in package.json to prevent installation of compromised versions
npm install eslint-config-prettier@10.1.5
🧯 If You Can't Patch
- Immediately isolate affected systems from network
- Perform malware scan and remove node-gyp.dll if present
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for affected versions (8.10.1, 9.1.1, 10.1.6, 10.1.7)Check Version:
npm list eslint-config-prettierVerify Fix Applied:
Run: npm list eslint-config-prettier and verify version is not affected📡 Detection & Monitoring
Log Indicators:
- npm install logs showing affected versions
- Windows Event Logs showing node-gyp.dll execution
Network Indicators:
- Unexpected outbound connections from development systems
- DNS queries to suspicious domains
SIEM Query:
Process creation where command_line contains 'node-gyp.dll' OR parent_process contains 'npm'🔗 References
- https://github.com/prettier/eslint-config-prettier/issues/339
- https://news.ycombinator.com/item?id=44608811
- https://news.ycombinator.com/item?id=44609732
- https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise
- https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/
- https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions
- https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise
- https://github.com/community-scripts/ProxmoxVE/discussions/6115
- https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only
- https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313
