~ / search / GHSA-f29h-pxvx-f335

GHSA-f29h-pxvx-f335

eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

Source: GitHub Advisory Database (reviewed) High CVE-2025-54313

Packages

EcosystemPackageAffectedFixed in
npm eslint-config-prettier >= 8.10.1, < 8.10.2 8.10.2
npm eslint-config-prettier >= 9.1.1, < 9.1.2 9.1.2
npm eslint-config-prettier >= 10.1.6, < 10.1.8 10.1.8
npm eslint-plugin-prettier >= 4.2.2, < 4.2.4 4.2.4
npm synckit >= 0.11.9, < 0.11.10 0.11.10
npm @pkgr/core >= 0.2.8, < 0.2.9 0.2.9
npm napi-postinstall >= 0.3.1, < 0.3.2 0.3.2
npm got-fetch >= 5.1.11, < 6.0.0 6.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

References

External links from the advisory. They lead to third-party sites.