CVE-2025-54313 in eslint-config-prettier
Summary
by MITRE • 07/19/2025
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/22/2026
The vulnerability identified as CVE-2025-54313 represents a sophisticated supply chain compromise targeting the eslint-config-prettier npm package ecosystem. This malicious payload affects multiple versions including 8.10.1, 9.1.1, 10.1.6, and 10.1.7, making it particularly dangerous as it could potentially impact a wide range of development environments that rely on these popular code formatting and linting tools. The attack vector leverages the trust model inherent in npm package management where developers install dependencies without thoroughly examining their contents, creating an ideal environment for supply chain attacks to succeed.
The technical implementation of this vulnerability involves the strategic embedding of malicious code within legitimate package distributions through the install.js file that executes automatically during package installation. This file serves as the initial delivery mechanism for the node-gyp.dll malware, which specifically targets Windows operating systems. The malware deployment mechanism demonstrates sophisticated understanding of Windows execution environments and package installation workflows, suggesting the attackers have deep knowledge of both the npm ecosystem and Windows system internals. The use of node-gyp.dll indicates the attackers leveraged existing Windows DLL infrastructure to avoid detection while maintaining persistence capabilities.
The operational impact of this vulnerability extends far beyond simple code corruption or data theft, as it fundamentally compromises the integrity of development environments and potentially extends to production systems. When developers install affected packages, their systems become compromised without their knowledge, creating a persistent threat that can be leveraged for various malicious activities including data exfiltration, system reconnaissance, or as a foothold for further attacks. The vulnerability affects the core development workflow, potentially leading to compromised source code repositories, unauthorized access to development systems, and the potential for additional supply chain attacks through compromised development environments. This type of attack directly violates the principle of least privilege and trust in software development ecosystems.
Organizations and developers should immediately implement comprehensive mitigation strategies including immediate package version updates to patched versions, implementation of npm audit and dependency checking procedures, and deployment of network monitoring to detect unusual outbound connections. The vulnerability aligns with ATT&CK technique T1133 (External Remote Services) and CWE-502 (Deserialization of Untrusted Data) as it exploits trusted package installation mechanisms while leveraging legitimate system components for malicious purposes. Security teams must also consider implementing software composition analysis tools and maintain strict version control policies to prevent installation of compromised packages. The incident highlights the critical need for continuous security monitoring of development dependencies and demonstrates how seemingly benign configuration packages can serve as entry points for sophisticated cyber attacks.