PT-2025-30145 · Unknown · Node-Gyp.Dll+1

Butz · Published 2025-07-19 · Updated 2026-01-26 · CVE-2025-54313

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions eslint-config-prettier versions 8.10.1 through 10.1.7

Description The eslint-config-prettier npm package was compromised through a supply chain attack resulting from a phishing attack on maintainers. Installation of affected versions executes an install.js file, which launches the node-gyp.dll malware on Windows systems. The package has over 30 million weekly downloads, representing a significant supply chain risk. The malicious code was injected via a postinstall script that utilizes rundll32.exe to execute a trojan. This issue affects not only direct users of the package but also projects that include it as a development dependency. The install.js file is executed upon package installation.

Recommendations Versions prior to 8.10.1 and versions after 10.1.7 should be used. For versions 8.10.1 through 9.1.1 and 10.1.7, avoid installation. For version 10.1.6, no action is required as it has been determined to be safe.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2025-54313

GHSA-F29H-PXVX-F335

Affected Products

Eslint-Config-Prettier

Node-Gyp.Dll

References · 41

• 🔥 https://bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware · Exploit
• 🔥 https://stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise · Exploit
• https://osv.dev/vulnerability/CVE-2025-54313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54313 · Security Note
• https://osv.dev/vulnerability/GHSA-f29h-pxvx-f335 · Vendor Advisory
• https://github.com/community-scripts/ProxmoxVE/discussions/6115 · Note
• https://github.com/prettier/eslint-config-prettier/issues/339 · Note
• https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 · Note
• https://github.com/prettier/eslint-config-prettier · Note
• https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 · Note
• https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 · Note
• https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd · Note
• https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 · Note
• https://twitter.com/transilienceai/status/2014903866207437122 · Twitter Post
• https://news.ycombinator.com/item?id=44608811 · Note