GHSA-f29h-pxvx-f335 CVE-2025-54313
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
High
Known exploited
npm
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 5.12%
- Chance of exploitation in the next 30 days. Higher than 92.39% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Jan 22, 2026
- Weakness
- CWE-506 Embedded Malicious Code
- Fix
- Available
- 6 packages have a fixed version
Exploited in the wild. Prettier eslint-config-prettier Embedded Malicious Code Vulnerability (Prettier eslint-config-prettier). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Feb 12, 2026.
Description
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @pkgr/core | 1 listed versions | No fix yet |
| @pkgr/core | >= 0.2.8, < 0.2.9 |
0.2.9 |
| eslint-config-prettier | 1 listed versions | No fix yet |
| eslint-config-prettier | 1 listed versions | No fix yet |
| eslint-config-prettier | >= 10.1.6, <= 10.1.7 |
No fix yet |
| eslint-config-prettier | >= 8.10.1, < 8.10.2 |
8.10.2 |
| eslint-config-prettier | >= 9.1.1, < 9.1.2 |
9.1.2 |
| eslint-config-prettier | >= 10.1.6, < 10.1.8 |
10.1.8 |
| eslint-plugin-prettier | >= 4.2.2, <= 4.2.3 |
No fix yet |
| eslint-plugin-prettier | >= 4.2.2, < 4.2.4 |
4.2.4 |
| got-fetch | >= 5.1.11, <= 5.1.12 |
No fix yet |
| got-fetch | >= 5.1.11, < 6.0.0 |
6.0.0 |
| napi-postinstall | 1 listed versions | No fix yet |
| napi-postinstall | >= 0.3.1, < 0.3.2 |
0.3.2 |
| synckit | 1 listed versions | No fix yet |
| synckit | >= 0.11.9, < 0.11.10 |
0.11.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
@pkgr/core npm → 0.2.9
- npm
npm install @pkgr/core@0.2.9- yarn
yarn add @pkgr/core@0.2.9- pnpm
pnpm add @pkgr/core@0.2.9
eslint-config-prettier npm → 8.10.2
- npm
npm install eslint-config-prettier@8.10.2- yarn
yarn add eslint-config-prettier@8.10.2- pnpm
pnpm add eslint-config-prettier@8.10.2
eslint-plugin-prettier npm → 4.2.4
- npm
npm install eslint-plugin-prettier@4.2.4- yarn
yarn add eslint-plugin-prettier@4.2.4- pnpm
pnpm add eslint-plugin-prettier@4.2.4
got-fetch npm → 6.0.0
- npm
npm install got-fetch@6.0.0- yarn
yarn add got-fetch@6.0.0- pnpm
pnpm add got-fetch@6.0.0
napi-postinstall npm → 0.3.2
- npm
npm install napi-postinstall@0.3.2- yarn
yarn add napi-postinstall@0.3.2- pnpm
pnpm add napi-postinstall@0.3.2
synckit npm → 0.11.10
- npm
npm install synckit@0.11.10- yarn
yarn add synckit@0.11.10- pnpm
pnpm add synckit@0.11.10
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Weakness
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it
- Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
References
Advisories
Fixes and patches
- github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a87…
- github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa…
- github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9
- github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd
- github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4
Packages
Other links
- github.com/prettier/eslint-config-prettier/issues/339
- news.ycombinator.com/item
- news.ycombinator.com/item
- socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compro…
- bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-d…
- npmjs.com/package/eslint-config-prettier
- stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-show…
- github.com/community-scripts/ProxmoxVE/discussions/6115
- endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-sever…
- secure.software/npm/packages/got-fetch
- checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm…
- cisa.gov/known-exploited-vulnerabilities-catalog
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| MAL-2025-6026 Malicious code in synckit (npm) | Not rated yet | Also affects synckit |
| MAL-2025-6021 Malicious code in @pkgr/core (npm) | Not rated yet | Also affects @pkgr/core |
| CVE-2026-48027 Compromised Nx Console version 18.95.0 | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2026-8398 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-g7cv-rxg3-hmpx Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware | Critical | Same weakness, CWE-506 |
| GHSA-69fq-xp46-6x23 Trivy ecosystem supply chain was briefly compromised | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2025-59374 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain… | Critical Known exploited | Same weakness, CWE-506 |
Credits: Pradoxzon
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor