Prettier · eslint-config-prettier
The eslint-config-prettier package (from Prettier) contains embedded malicious code in versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7, injected as part of a supply chain compromise. An attacker who gets a user to install an affected version can run a malicious install.js script that launches node-gyp.dll malware on Windows, which requires no prior authentication and no network-positioning beyond the install itself, though the install step is ultimately triggered by the user or their build process.
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 7 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
supply chain compromise via trojanized package
has embedded malicious code for a supply chain compromise
install.js script launches malware
executes an install.js file that launches the node-gyp.dll malware
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
6 packages in 1 ecosystem. Main package: eslint-config-prettier.
Upgrade to 10.1.8 or later
npm install eslint-config-prettier@10.1.8The first fix for CVE-2025-54313. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 10.1.6 up to 10.1.8 | 10.1.8 |
| 9.1.1 up to 9.1.2 | 9.1.2 |
| 8.10.1 up to 8.10.2 | 8.10.2 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.