CVE-2025-54313

What is eslint-config-prettier?

eslint-config-prettier is an npm package that disables ESLint rules that would conflict with Prettier's code formatting. It is used by virtually every JavaScript/TypeScript project that combines ESLint (linting) with Prettier (formatting) — an extremely common combination in modern JavaScript development. With over 30 million weekly downloads at the time of the incident, it is one of the most widely used packages in the JavaScript ecosystem. It is typically installed as a development dependency and runs during npm install.

Overview

CVE-2025-54313 is an embedded malicious code (CWE-506) vulnerability in the eslint-config-prettier npm package. On July 18, 2025, an attacker stole the npm publish credentials of the package maintainer (JounQin) via a phishing attack using a typosquatted domain (npnjs.com impersonating npmjs.com). The attacker used the stolen token to publish trojanized versions containing a malicious install.js script and node-gyp.dll Windows malware. The payload executes at npm install time on Windows systems. The same attacker compromised related packages (eslint-plugin-prettier, synckit) owned by the same maintainer.

Affected Versions

All malicious versions were deprecated on npm after discovery. Clean replacement versions were published.

Technical Details

The attack exploited the npm postinstall hook mechanism — npm install automatically executes scripts defined in a package's package.json under scripts.postinstall. The trojanized versions added:

1. install.js: An obfuscated postinstall script that runs automatically on npm install
2. node-gyp.dll: A malicious Windows DLL placed in the package directory

The install.js script invokes node-gyp.dll via rundll32.exe — a standard Windows executable used to run DLL exports. The DLL executes on Windows systems only (the payload is a PE executable). The full capabilities of node-gyp.dll were not completely reversed publicly, but the malware performs Windows system reconnaissance and is assessed to have persistence and data exfiltration capabilities.

The attack delivery mechanism:

• Attacker phishes maintainer with npnjs.com (typosquatted npmjs.com) → steals npm auth token
• Uses token to npm publish trojanized versions
• CI/CD pipelines and developer machines running npm install automatically execute install.js
• node-gyp.dll runs via rundll32, executing the Windows malware payload

Automated detection: RenovateBot — an automated dependency update bot — flagged a discrepancy between the npm package contents and the GitHub repository (the malicious files were not in git), alerting the security community within hours.

Discovery

RenovateBot detected the npm/GitHub discrepancy automatically on July 18, 2025. The maintainer confirmed the incident shortly after.

Exploitation Context

The 30+ million weekly download count made this a potentially massive supply chain incident. However, the Windows-only payload limited actual exploitation: many JavaScript developers work on macOS or Linux. CISA added the vulnerability to the KEV catalog on January 22, 2026, alongside CVE-2025-68645 and CVE-2025-34026 — indicating confirmed exploitation in the wild in CI/CD and developer environments.

Remediation

1. Immediately remove malicious versions and upgrade to the next clean version of each affected package.
2. Audit node_modules in all projects for the presence of node-gyp.dll and install.js — if found, treat the system as compromised.
3. Rotate all credentials accessible from any developer machine or CI/CD runner that ran npm install with the malicious versions: npm tokens, cloud provider credentials (AWS, GCP, Azure), SSH keys, code signing certificates.
4. Audit CI/CD runners for persistence mechanisms: unexpected scheduled tasks, services, or registry entries created by node-gyp.dll.
5. Lock package-lock.json and use npm ci rather than npm install in CI/CD — this prevents installing newly published versions without review.
6. Enable npm audit in CI pipelines and act on supply chain alerts promptly.
7. Review your npm credential management — use per-project tokens with minimal scopes; enable npm's two-factor authentication requirement for publishing.