eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for…
Priority CRITICAL 90Exploited in the wildCWE-506Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-506.
Summary
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Why it matters now
Exploitation Active In CISA KEV since 2026-01-22CISA due date 2026-02-12
EPSS 0.05125 92nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed eslint-config-prettier (npm): 8.10.2, 9.1.2, 10.1.8eslint-plugin-prettier (npm): 4.2.4+4 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Prettier | eslint-config-prettier | 8.10.1; 9.1.1; 10.1.6; 10.1.7 | — | No fix listed | CNA |
| — | eslint-config-prettier (npm) | 8.10.1 to before 8.10.2 | 8.10.2 | Patch available | GHSA-f29h-pxvx-f335 |
| — | eslint-config-prettier (npm) | 9.1.1 to before 9.1.2 | 9.1.2 | Patch available | GHSA-f29h-pxvx-f335 |
| — | eslint-config-prettier (npm) | 10.1.6 to before 10.1.8 | 10.1.8 | Patch available | GHSA-f29h-pxvx-f335 |
| — | eslint-plugin-prettier (npm) | 4.2.2 to before 4.2.4 | 4.2.4 | Patch available | GHSA-f29h-pxvx-f335 |
| — | synckit (npm) | 0.11.9 to before 0.11.10 | 0.11.10 | Patch available | GHSA-f29h-pxvx-f335 |
| — | @pkgr/core (npm) | 0.2.8 to before 0.2.9 | 0.2.9 | Patch available | GHSA-f29h-pxvx-f335 |
| — | napi-postinstall (npm) | 0.3.1 to before 0.3.2 | 0.3.2 | Patch available | GHSA-f29h-pxvx-f335 |
| — | got-fetch (npm) | 5.1.11 to before 6.0.0 | 6.0.0 | Patch available | GHSA-f29h-pxvx-f335 |
- eslint-config-prettier VendorPrettier Affected 8.10.1; 9.1.1; 10.1.6; 10.1.7 Fixed in — No fix listed CNA
- eslint-config-prettier (npm) Vendor— Affected 8.10.1 to before 8.10.2 Fixed in 8.10.2 Patch available GHSA-f29h-pxvx-f335
- eslint-config-prettier (npm) Vendor— Affected 9.1.1 to before 9.1.2 Fixed in 9.1.2 Patch available GHSA-f29h-pxvx-f335
- eslint-config-prettier (npm) Vendor— Affected 10.1.6 to before 10.1.8 Fixed in 10.1.8 Patch available GHSA-f29h-pxvx-f335
- eslint-plugin-prettier (npm) Vendor— Affected 4.2.2 to before 4.2.4 Fixed in 4.2.4 Patch available GHSA-f29h-pxvx-f335
- synckit (npm) Vendor— Affected 0.11.9 to before 0.11.10 Fixed in 0.11.10 Patch available GHSA-f29h-pxvx-f335
- @pkgr/core (npm) Vendor— Affected 0.2.8 to before 0.2.9 Fixed in 0.2.9 Patch available GHSA-f29h-pxvx-f335
- napi-postinstall (npm) Vendor— Affected 0.3.1 to before 0.3.2 Fixed in 0.3.2 Patch available GHSA-f29h-pxvx-f335
- got-fetch (npm) Vendor— Affected 5.1.11 to before 6.0.0 Fixed in 6.0.0 Patch available GHSA-f29h-pxvx-f335
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:prettier:eslint-config-prettier:8.10.1:*:*:*:*:node.js:*:* | 8.10.1 | Vulnerable | Prettier |
| cpe:2.3:a:prettier:eslint-config-prettier:9.1.1:*:*:*:*:node.js:*:* | 9.1.1 | Vulnerable | Prettier |
| cpe:2.3:a:prettier:eslint-config-prettier:10.1.6:*:*:*:*:node.js:*:* | 10.1.6 | Vulnerable | Prettier |
| cpe:2.3:a:prettier:eslint-config-prettier:10.1.7:*:*:*:*:node.js:*:* | 10.1.7 | Vulnerable | Prettier |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.2:*:*:*:*:node.js:*:* | 4.2.2 | Vulnerable | Prettier |
| cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.3:*:*:*:*:node.js:*:* | 4.2.3 | Vulnerable | Prettier |
| cpe:2.3:a:un-ts:synckit:0.11.9:*:*:*:*:node.js:*:* | 0.11.9 | Vulnerable | Un-ts |
| cpe:2.3:a:un-ts:pkgr\/core:0.2.8:*:*:*:*:node.js:*:* | 0.2.8 | Vulnerable | Un-ts |
| cpe:2.3:a:alexghr:got-fetch:5.1.1:*:*:*:*:node.js:*:* | 5.1.1 | Vulnerable | Alexghr |
- cpe:2.3:a:prettier:eslint-config-prettier:8.10.1:*:*:*:*:node.js:*:* Versions 8.10.1 Vulnerable ·Prettier
- cpe:2.3:a:prettier:eslint-config-prettier:9.1.1:*:*:*:*:node.js:*:* Versions 9.1.1 Vulnerable ·Prettier
- cpe:2.3:a:prettier:eslint-config-prettier:10.1.6:*:*:*:*:node.js:*:* Versions 10.1.6 Vulnerable ·Prettier
- cpe:2.3:a:prettier:eslint-config-prettier:10.1.7:*:*:*:*:node.js:*:* Versions 10.1.7 Vulnerable ·Prettier
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.2:*:*:*:*:node.js:*:* Versions 4.2.2 Vulnerable ·Prettier
- cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.3:*:*:*:*:node.js:*:* Versions 4.2.3 Vulnerable ·Prettier
- cpe:2.3:a:un-ts:synckit:0.11.9:*:*:*:*:node.js:*:* Versions 0.11.9 Vulnerable ·Un-ts
- cpe:2.3:a:un-ts:pkgr\/core:0.2.8:*:*:*:*:node.js:*:* Versions 0.2.8 Vulnerable ·Un-ts
- cpe:2.3:a:alexghr:got-fetch:5.1.1:*:*:*:*:node.js:*:* Versions 5.1.1 Vulnerable ·Alexghr
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:alexghr:got-fetch:5.1.2:*:*:*:*:node.js:*:* | 5.1.2 | Vulnerable | Alexghr |
| cpe:2.3:a:un-ts:napi-postinstall:0.3.1:*:*:*:*:node.js:*:* | 0.3.1 | Vulnerable | Un-ts |
| cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:* | 1.29.0 to before 1.30.0 | Vulnerable | homarr-labs |
- cpe:2.3:a:alexghr:got-fetch:5.1.2:*:*:*:*:node.js:*:* Versions 5.1.2 Vulnerable ·Alexghr
- cpe:2.3:a:un-ts:napi-postinstall:0.3.1:*:*:*:*:node.js:*:* Versions 0.3.1 Vulnerable ·Un-ts
- cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:* Versions 1.29.0 to before 1.30.0 Vulnerable ·homarr-labs
Remediation
- Fix · GHSA-f29h-pxvx-f335 eslint-config-prettier (npm) Fixed in 8.10.2 Advisory →
- Fix · GHSA-f29h-pxvx-f335 eslint-config-prettier (npm) Fixed in 9.1.2 Advisory →
- Fix · GHSA-f29h-pxvx-f335 eslint-config-prettier (npm) Fixed in 10.1.8 Advisory →
- Fix · GHSA-f29h-pxvx-f335 eslint-plugin-prettier (npm) Fixed in 4.2.4 Advisory →
- Fix · GHSA-f29h-pxvx-f335 synckit (npm) Fixed in 0.11.10 Advisory →
- Fix · GHSA-f29h-pxvx-f335 @pkgr/core (npm) Fixed in 0.2.9 Advisory →
- Fix · GHSA-f29h-pxvx-f335 napi-postinstall (npm) Fixed in 0.3.2 Advisory →
- Fix · GHSA-f29h-pxvx-f335 got-fetch (npm) Fixed in 6.0.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 19 products
- Migration Toolkit for Virtualization
- OpenShift Lightspeed
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat OpenShift distributed tracing 3
- Red Hat Process Automation 7
- Red Hat Trusted Artifact Signer
- streams for Apache Kafka 2
Timeline
- 2026-01-22 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-54313
- 2026-10-03 Alias added: GHSA-f29h-pxvx-f335
- 2026-10-27 Affected versions changed · Red Hat
References
Exploit 2
Advisory 4
- https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise
- https://nvd.nist.gov/vuln/detail/CVE-2025-54313
- https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only
- https://github.com/community-scripts/ProxmoxVE/discussions/6115
Other 14
- https://github.com/prettier/eslint-config-prettier/issues/339
- https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions
- https://news.ycombinator.com/item?id=44609732
- https://news.ycombinator.com/item?id=44608811
- https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385
- https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854
- https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9
- https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd
- https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313
- https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware
- https://secure.software/npm/packages/got-fetch
- https://github.com/prettier/eslint-config-prettier
- https://checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1
Sources
- CVE-2025-54313 · CVE Program
- CVE-2025-54313 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-f29h-pxvx-f335 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-54313 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences