CVE-2025-54313: eslint-config-prettier npm package ships malicious install script

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is confirmed exploited and in CISA KEV, but the payload is Windows-only and requires installing a specific compromised package version, which limits exposure compared with a remotely reachable production service flaw.

What it is

Versions 8.10.1, 9.1.1, 10.1.6 and 10.1.7 of eslint-config-prettier contain embedded malicious code: installing the package runs an install.js that launches node-gyp.dll malware on Windows. This is a supply chain compromise of a widely used developer tool, so the risk lands on developer workstations and CI runners rather than on production servers.

Impact

An attacker gains code execution on any Windows machine that installs an affected version, with the malware running under the installing user's privileges. The CVSS vector rates integrity impact as High and confidentiality as Low, so the primary concern is tampering and follow-on payload activity rather than mass data theft.

Attack surface

Reached through the npm install process: the malicious install.js executes automatically when the package is installed, requiring no authentication and no user interaction beyond the install itself. The description and CVSS vector (AV:N, PR:N, UI:N) indicate remote, unauthenticated triggering, with the payload specifically targeting Windows.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2026-01-22, confirming real-world exploitation, and multiple references are tagged Exploit. EPSS gives a 30-day probability of 0.04348 (90.7th percentile), and no ransomware campaign use is documented.

What to do

• Remove or upgrade any installation of eslint-config-prettier 8.10.1, 9.1.1, 10.1.6 or 10.1.7 to a clean version, and rebuild lockfiles so the malicious tarball is not reinstalled.
• Follow CISA KEV required action and applicable BOD 22-01 guidance; if a clean version is unavailable, discontinue use of the package.
• Block or pin the affected versions in npm registries and CI caches, and audit other listed packages (eslint-plugin-prettier, synckit, pkgr/core, got-fetch, napi-postinstall, homarr) for the same compromise.
• Treat any Windows host that installed an affected version as compromised: isolate it, hunt for node-gyp.dll and related persistence, and rotate credentials and tokens used on that host.

Detection

• Search build logs, npm install output and package-lock.json files for eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6 or 10.1.7.
• Hunt for node-gyp.dll on Windows developer and CI hosts, especially outside expected node-gyp build paths, and check for unexpected child processes spawned by npm install.
• Monitor for outbound network connections from npm install or node processes on developer workstations and build runners.
• Review CI/CD pipeline history for installs of the affected versions and any subsequent anomalous process execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.