CVE-2025-54313

Known Exploited Vulnerability

Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

Vendor / product: Prettier / eslint-config-prettier

Description

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Weakness classification

• cve@mitre.org: CWE-506

Primary references

• cve@mitre.org — Issue Tracking
• cve@mitre.org — Issue Tracking
• cve@mitre.org — Issue Tracking
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Product
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource