CVE-2025-54313: Malicious Code Embedded in eslint-config-prettier and Related Packages
Summary
CVE-2025-54313: eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Affects eslint-config-prettier across 3 version ranges.
>= 8.10.1, < 8.10.2
>= 9.1.1, < 9.1.2
>= 10.1.6, < 10.1.8
Fixed in 8.10.2, 9.1.2 or 10.1.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eslint-config-prettier is an npm package that disables formatting rules in ESLint that conflict with Prettier, a popular code formatter. It is widely used in JavaScript projects to ensure consistent code style. However, certain versions of this package, along with eslint-plugin-prettier, synckit, @pkgr/core, and napi-postinstall, have been found to contain malicious code that compromises the integrity of the software supply chain.
Vulnerability Detail
The vulnerability arises from the inclusion of malicious code in versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 of eslint-config-prettier, as well as other related packages. This malicious code executes an install.js file that launches the node-gyp.dll malware on Windows systems. The ramifications of this vulnerability include potential unauthorized access to system resources, data theft, and further exploitation of the affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.10.1, < 8.10.28.10.2npm install eslint-config-prettier@8.10.2 -
>= 9.1.1, < 9.1.29.1.2npm install eslint-config-prettier@9.1.2 -
>= 10.1.6, < 10.1.810.1.8npm install eslint-config-prettier@10.1.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider removing the affected packages temporarily until a secure version can be installed. You can do this by running: npm uninstall eslint-config-prettier eslint-plugin-prettier synckit @pkgr/core napi-postinstall
Conclusion
The discovery of malicious code in eslint-config-prettier and related packages highlights the importance of maintaining secure dependencies in software projects. Users are urged to update their packages promptly to mitigate risks associated with this vulnerability.
See every vulnerability recorded for eslint-config-prettier →
FAQ
CVE-2025-54313 is a vulnerability affecting certain versions of eslint-config-prettier and related packages, which contain embedded malicious code.
If your project uses the affected versions of these packages, it may be at risk of malware execution, leading to potential data breaches and system compromise.
You should immediately update to the patched versions of the affected packages or remove them until a secure version is available.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json. You can also check your application for vulnerabilities using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for eslint-config-prettier.
