CVE-2025-54313 Prettier eslint-config-prettier Embedded Malicious Code
Malicious code in eslint-config-prettier executes malware during installation on Windows, requiring users to upgrade to a safe version.
- Exploited in the wild
- Since 22 Jan 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54313?
CVE-2025-54313 is a high-severity vulnerability in eslint-config-prettier, published on 19 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Weakness: CWE-506
Which versions are affected by CVE-2025-54313?
16 open source packages ship an affected version, including eslint-config-prettier, @pkgr/core and eslint-plugin-prettier. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
eslint-config-prettier npm | From 10.1.6 | 10.1.8 |
eslint-config-prettier npm | From 10.1.6 | 10.1.8 |
eslint-config-prettier npm | From 8.10.1 | 8.10.2 |
eslint-config-prettier npm | From 8.10.1 | 8.10.2 |
eslint-config-prettier npm | From 9.1.1 | 9.1.2 |
eslint-config-prettier npm | From 9.1.1 | 9.1.2 |
10 more packages
@pkgr/core npm | From 0.2.8 | 0.2.9 |
@pkgr/core npm | From 0.2.8 | 0.2.9 |
eslint-plugin-prettier npm | From 4.2.2 | 4.2.4 |
eslint-plugin-prettier npm | From 4.2.2 | 4.2.4 |
got-fetch npm | From 5.1.11 | 6.0.0 |
got-fetch npm | From 5.1.11 | 6.0.0 |
napi-postinstall npm | From 0.3.1 | 0.3.2 |
napi-postinstall npm | From 0.3.1 | 0.3.2 |
synckit npm | From 0.11.9 | 0.11.10 |
synckit npm | From 0.11.9 | 0.11.10 |
Products include Alexghr Got-Fetch, Homarr Homarr, Prettier Eslint-Config-Prettier, Prettier Eslint-Plugin-Prettier, Un-Ts Napi-Postinstall, Un-Ts Pkgr\/Core and 1 more.
How do I fix CVE-2025-54313?
Upgrade eslint-config-prettier to a fixed version for your release line: 10.1.8, 8.10.2 or 9.1.2. US federal agencies must fix it by 12 Feb 2026.
Is CVE-2025-54313 being exploited?
Yes. Attackers have exploited CVE-2025-54313 in the wild since at least 22 Jan 2026.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-f29h-pxvx-f335.