---
id: "CVE-2025-54313"
kind: "vulnerability"
aliases: ["CVE-2025-54313"]
title: "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise"
severity: "critical"
cvss: 7.5
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Prettier eslint-config-prettier", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "prettier eslint-config-prettier", "fixed": [], "affected": "= 8.10.1", "ecosystem": "vendor"}, {"name": "prettier eslint-config-prettier", "fixed": [], "affected": "= 9.1.1", "ecosystem": "vendor"}, {"name": "prettier eslint-config-prettier", "fixed": [], "affected": "= 10.1.6", "ecosystem": "vendor"}, {"name": "prettier eslint-config-prettier", "fixed": [], "affected": "= 10.1.7", "ecosystem": "vendor"}, {"name": "prettier eslint-plugin-prettier", "fixed": [], "affected": "= 4.2.2", "ecosystem": "vendor"}, {"name": "prettier eslint-plugin-prettier", "fixed": [], "affected": "= 4.2.3", "ecosystem": "vendor"}, {"name": "un-ts synckit", "fixed": [], "affected": "= 0.11.9", "ecosystem": "vendor"}, {"name": "un-ts pkgr\\/core", "fixed": [], "affected": "= 0.2.8", "ecosystem": "vendor"}, {"name": "alexghr got-fetch", "fixed": [], "affected": "= 5.1.1", "ecosystem": "vendor"}, {"name": "alexghr got-fetch", "fixed": [], "affected": "= 5.1.2", "ecosystem": "vendor"}, {"name": "un-ts napi-postinstall", "fixed": [], "affected": "= 0.3.1", "ecosystem": "vendor"}, {"name": "homarr", "fixed": ["1.30.0"], "affected": ">= 1.29.0, < 1.30.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ci", "exploited", "javascript", "npm", "package", "windows"]
not_affected_if: ["linux-only-installs", "version-not-in-affected-range"]
published_at: "2025-07-19T17:15:23+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54313", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise

The eslint-config-prettier npm package carries embedded malicious code: installing it runs an install.js script that launches a node-gyp.dll malware payload on Windows. An attacker gets code execution on the machine that installs the affected package version.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Prettier eslint-config-prettier affected ? fixed ?
- vendor:prettier eslint-config-prettier affected = 8.10.1 fixed ?
- vendor:prettier eslint-config-prettier affected = 9.1.1 fixed ?
- vendor:prettier eslint-config-prettier affected = 10.1.6 fixed ?
- vendor:prettier eslint-config-prettier affected = 10.1.7 fixed ?
- vendor:prettier eslint-plugin-prettier affected = 4.2.2 fixed ?
- vendor:prettier eslint-plugin-prettier affected = 4.2.3 fixed ?
- vendor:un-ts synckit affected = 0.11.9 fixed ?
- vendor:un-ts pkgr\/core affected = 0.2.8 fixed ?
- vendor:alexghr got-fetch affected = 5.1.1 fixed ?
- vendor:alexghr got-fetch affected = 5.1.2 fixed ?
- vendor:un-ts napi-postinstall affected = 0.3.1 fixed ?
- vendor:homarr affected >= 1.29.0, < 1.30.0 fixed 1.30.0

## How to check

Run npm ls eslint-config-prettier in each project and check the installed version against the affected versions listed in the advisory.
Search lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for eslint-config-prettier and look for an install.js or node-gyp.dll artifact in node_modules.

## Fix

Remove the affected eslint-config-prettier version, reinstall from a clean lockfile, and move to a version the vendor lists as fixed: unknown in the sources.
Treat any Windows machine that installed the package as compromised: rotate credentials and review it per CISA's required action (vendor mitigations, or discontinue use).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-54313

## From the sources

Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_