CVE-2025-54313: Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

This vulnerability affects the eslint-config-prettier package used with Prettier in JavaScript projects. It stems from embedded malicious code that runs automatically during package installation on Windows systems, executing an install.js script that launches node-gyp.dll malware. The issue matters because development environments often pull dependencies without deep inspection, allowing supply-chain compromise to occur silently during routine npm or yarn operations.

How it works

The weakness is classified as CWE-506, embedded malicious code. An attacker places the malicious payload inside the published package so that the package manager's standard install lifecycle triggers execution. On Windows, the install.js file runs and starts node-gyp.dll. No further attacker interaction is required after the initial package installation.

Am I affected? How to find it in your systems

• Locate Node.js projects that declare eslint-config-prettier in package.json or lockfiles managed by npm, yarn, or pnpm.
• Inventory all direct and transitive dependencies; compare installed versions against the vendor advisory to identify affected instances.
• Scan development workstations and CI pipelines for the presence of install.js files or node-gyp.dll binaries introduced under the eslint-config-prettier path.
• Review Windows event logs and process-creation telemetry for unexpected execution of node-gyp.dll during package-install steps.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, remove any previously installed affected packages and clear associated cache directories. For this class of supply-chain weakness, organizations should also enforce package-integrity verification through lockfile enforcement and restrict installation sources to trusted registries.

If you can't patch immediately

• Isolate affected build and developer systems from production networks until remediation is complete.
• Monitor endpoints for execution of install.js or node-gyp.dll and alert on any matches.
• Follow CISA BOD 22-01 guidance for cloud-hosted build services or discontinue use of the package if mitigations cannot be applied.

If your data may have been exposed

Actively exploited vulnerabilities of this type have led to data breaches. You can run a free exposure scan of your email addresses against known breach datasets to check for prior compromise.