Vulnerability DatabaseCVE-2025-54313
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-54313
July 19, 2025
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Affected Packages
got-fetch (NPM):
Affected version(s) >=5.1.11 <6.0.0
Fix Suggestion:
Update to version 6.0.0
eslint-config-prettier (NPM):
Affected version(s) >=10.1.6 <10.1.8
Fix Suggestion:
Update to version 10.1.8
eslint-config-prettier (NPM):
Affected version(s) =8.10.1 <8.10.2
Fix Suggestion:
Update to version 8.10.2
eslint-config-prettier (NPM):
Affected version(s) =9.1.1 <9.1.2
Fix Suggestion:
Update to version 9.1.2
@pkgr/core (NPM):
Affected version(s) =0.2.8 <0.2.9
Fix Suggestion:
Update to version 0.2.9
synckit (NPM):
Affected version(s) =0.11.9 <0.11.10
Fix Suggestion:
Update to version 0.11.10
napi-postinstall (NPM):
Affected version(s) =0.3.1 <0.3.2
Fix Suggestion:
Update to version 0.3.2
eslint-plugin-prettier (NPM):
Affected version(s) >=4.2.2 <4.2.4
Fix Suggestion:
Update to version 4.2.4
Related Resources (20)
https://github.com/prettier/eslint-config-prettier/issues/339
https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only
https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd
https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4
https://checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1
https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware
https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854
https://news.ycombinator.com/item?id=44608811
https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385
https://secure.software/npm/packages/got-fetch
https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise
https://nvd.nist.gov/vuln/detail/CVE-2025-54313
https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise
https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions
https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313
https://github.com/community-scripts/ProxmoxVE/discussions/6115
https://news.ycombinator.com/item?id=44609732
https://github.com/prettier/eslint-config-prettier
https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9
Do you need more information?
Contact Us
CVSS v4
Base Score:
9
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
HIGH
Subsequent System Availability
NONE
Exploit Maturity
ATTACKED
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
NONE
Exploit Maturity
HIGH
Weakness Type (CWE)
Embedded Malicious Code
CWE-506
EPSS
Base Score:
6.95