CVE-2025-54313 KEVPublic exploit High · 7.5 EPSS 5.1%

Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

Prettier · eslint-config-prettier

Summary

The eslint-config-prettier package (from Prettier) contains embedded malicious code in versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7, injected as part of a supply chain compromise. An attacker who gets a user to install an affected version can run a malicious install.js script that launches node-gyp.dll malware on Windows, which requires no prior authentication and no network-positioning beyond the install itself, though the install step is ultimately triggered by the user or their build process.

Official description · NVD

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Breakdown

66.7 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Tamper with software updates or packagesT1195.002 · Compromise Software Supply ChainAI-written (claude-haiku-5-5)Medium confidence17 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 7 days after disclosure.

DisclosedFirst seen exploitedVulnCheck KEV evidence19 Jul 2025day 0
Public exploit codePoC-in-GitHub26 Jul 2025+7 days
Added to CISA KEVEU database agrees22 Jan 2026+6 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 3 cited passages 2

Initial AccessTA0001

Compromise Software Supply Chain T1195.002 Medium

AI mapping from the description · how it is exploited

supply chain compromise via trojanized package

has embedded malicious code for a supply chain compromise

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

install.js script launches malware

executes an install.js file that launches the node-gyp.dll malware

From the official description (NVD) Original ↗

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Malicious FileT1204.002 server-side bug exploitable without user interaction; client-execution technique does not fit

Detection

0 rules for this CVE · 112 general rules for its techniques

Rules for this CVE

0 that reference CVE-2025-54313 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Compromise Software Supply ChainT1195.00217 general rules

Axios NPM Compromise File Creation Indicators - Linuxhighexperimental
Axios NPM Compromise File Creation Indicators - MacOShighexperimental
Axios NPM Compromise File Creation Indicators - Windowshighexperimental
Axios NPM Compromise Indicators - Linuxhighexperimental
Axios NPM Compromise Indicators - macOShighexperimental
Axios NPM Compromise Indicators - Windowshighexperimental
LiteLLM / TeamPCP Supply Chain Attack Indicatorshighexperimental
Shai-Hulud 2.0 Malicious NPM Package Installationhighexperimental

All 17 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

6 packages in 1 ecosystem. Main package: eslint-config-prettier.

npmeslint-config-prettierGHSA-f29h-pxvx-f335

Upgrade to 10.1.8 or later

npmnpm install eslint-config-prettier@10.1.8

The first fix for CVE-2025-54313. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you run	Upgrade to
10.1.6 up to 10.1.8	10.1.8
9.1.1 up to 9.1.2	9.1.2
8.10.1 up to 8.10.2	8.10.2

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (5)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

npmeslint-plugin-prettier
Affected: 4.2.2 up to 4.2.4Upgrade to 4.2.4 or later
GHSA-f29h-pxvx-f335
npmsynckit
Affected: 0.11.9 up to 0.11.10Upgrade to 0.11.10 or later
GHSA-f29h-pxvx-f335
npm@pkgr/core
Affected: 0.2.8 up to 0.2.9Upgrade to 0.2.9 or later
GHSA-f29h-pxvx-f335
npmnapi-postinstall
Affected: 0.3.1 up to 0.3.2Upgrade to 0.3.2 or later
GHSA-f29h-pxvx-f335
npmgot-fetch
Affected: 5.1.11 up to 6.0.0Upgrade to 6.0.0 or later
GHSA-f29h-pxvx-f335

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
44 more on OTX

References

10 links, grouped by NVD tag (1 duplicate merged)

Exploitation evidence

Exploited in the wild

Listed since 22 Jan 2026. Federal due date 12 Feb 2026. No recorded ransomware use.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 22 Jan 2026. EUVD-2025-21972

Public exploitAdvisories link exploit code.

, 30 Oct 2026

5.1%Top 7.6%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 92.4%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 469 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9238 18.5/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 2 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total66.7

Record

Published: 19 Jul 2025
Modified: 17 Jun 2026
: CWE-506 Embedded Malicious Code
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

US Government Resource 1

Third Party Advisory 5

Issue Tracking 3

Product 1

How attackers get in

What they do

techniques