CVE-2025-54313 in prettier eslint-config-prettier
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Affected software: prettier eslint-config-prettier, prettier eslint-plugin-prettier, un-ts synckit, un-ts pkgr/core, alexghr got-fetch, un-ts napi-postinstall, homarr
Scores
- CVSS: 7.5 (high)
- EPSS: 5.13% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-01-22
- Published: 2025-07-19
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Remove malicious eslint-config-prettier versions (CVE-2025-54313)
Workaround. Compromised eslint-config-prettier versions ran an install script that dropped node-gyp.dll malware on Windows. Pin a clean version, clear caches and check developer machines.
Applies to: Projects that installed the compromised eslint-config-prettier versions in July 2025.
- Search lockfiles for the compromised versions named in the eslint-config-prettier issue (reported as 8.10.1, 9.1.1, 10.1.6 and 10.1.7).
- Pin a clean version and reinstall; clear npm caches.
- On Windows machines that installed them, look for node-gyp.dll in the project or temp folders and run a full EDR scan.
- Rotate npm and cloud tokens used on affected machines.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.