p PatchFirst

CVE-2025-54313

CVE-2025-54313

This page contains facts from public vulnerability sources. Check the original advisory before updating.

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

CVSS 7.5 · High · EPSS 5.1% · In KEV · Fix available

Published
Updated

Stack: node

Affected products and versions

  • eslint-config-prettier

    Versions
    • 8.10.1: Affected (semver)
    • 9.1.1: Affected (semver)
    • 10.1.6: Affected (semver)
    • 10.1.7: Affected (semver)

    No fix published

  • eslint-config-prettier npm

    Versions
    • 8.10.1
    Affected ranges
    • SEMVER: ≥ 8.10.1, < 8.10.2

    Update to 8.10.2

  • eslint-config-prettier npm

    Versions
    • 9.1.1
    Affected ranges
    • SEMVER: ≥ 9.1.1, < 9.1.2

    Update to 9.1.2

  • eslint-config-prettier npm

    Affected ranges
    • SEMVER: ≥ 10.1.6, < 10.1.8

    Update to 10.1.8

  • eslint-plugin-prettier npm

    Affected ranges
    • SEMVER: ≥ 4.2.2, < 4.2.4

    Update to 4.2.4

  • synckit npm

    Versions
    • 0.11.9
    Affected ranges
    • SEMVER: ≥ 0.11.9, < 0.11.10

    Update to 0.11.10

  • @pkgr/core npm

    Versions
    • 0.2.8
    Affected ranges
    • SEMVER: ≥ 0.2.8, < 0.2.9

    Update to 0.2.9

  • napi-postinstall npm

    Versions
    • 0.3.1
    Affected ranges
    • SEMVER: ≥ 0.3.1, < 0.3.2

    Update to 0.3.2

  • got-fetch npm

    Affected ranges
    • SEMVER: ≥ 5.1.11, < 6.0.0

    Update to 6.0.0

Original sources

Check your server →