{"id":"eslint-config-prettier-malicious-releases-jul-2025","category":"supply-chain","status":"closed","title":"Poisoned eslint-config-prettier releases delivered Windows malware (CVE-2025-54313)","tldr":"A stolen maintainer token let attackers publish poisoned eslint-config-prettier releases in July 2025. CISA confirmed exploitation in January 2026. Developers should install clean replacements and investigate Windows machines that installed affected versions.","summary":"This software supply-chain attack began in July 2025, when phishing exposed a maintainer’s npm publishing token. Attackers used it to publish unauthorised versions of eslint-config-prettier, a tool developers use to prevent conflicts between ESLint and Prettier formatting rules. Installing poisoned releases could launch bundled malware on Windows developer computers or build machines. The maintainer revoked the token and deprecated the suspect releases; clean replacements are available for all three affected release lines. Related packages were also compromised. There is one unresolved reporting difference: GitHub lists 10.1.6 as affected, while JFrog says that release contained altered metadata but lacked the malware script and payload. CISA added CVE-2025-54313 to its exploited-vulnerability catalogue on 22 January 2026. As at 3 November 2026, the reviewed sources do not establish whether attacks are continuing. Replacing the dependency does not by itself remove malware or undo credential exposure.","action":"Nothing for you to do unless you or your IT team develops software using these packages. Ask developers to replace affected eslint-config-prettier releases with 8.10.2, 9.1.2 or 10.1.8 on the corresponding release line, and check related dependencies. Windows machines that installed poisoned packages need investigation, including replacement of any credentials that may have been exposed.","product":"eslint-config-prettier npm package","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-54313"],"tags":["prettier","eslint-config-prettier","npm","supply-chain","windows","malware","phishing"],"affected":["eslint-config-prettier 8.10.1","eslint-config-prettier 9.1.1","eslint-config-prettier 10.1.6 and 10.1.7; GitHub lists both, but JFrog reports that 10.1.6 lacks the malware payload"],"fixed":["eslint-config-prettier 8.10.2","eslint-config-prettier 9.1.2","eslint-config-prettier 10.1.8"],"matches":[],"sources":[{"kind":"post","title":"Maintainer confirmation and response: four new versions published with no code changes to repo","url":"https://github.com/prettier/eslint-config-prettier/issues/339","by":"eslint-config-prettier maintainers","date":"2025-07-18"},{"kind":"post","title":"fix: release a new latest version","url":"https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385","by":"eslint-config-prettier maintainers","date":"2025-07-18"},{"kind":"advisory","title":"CVE-2025-54313: embedded malicious code in npm packages","url":"https://github.com/advisories/GHSA-f29h-pxvx-f335","by":"GitHub","date":"2026-01-22"},{"kind":"research","title":"Active Supply Chain Attack: npm Phishing Campaign Leads to Prettier Tooling Packages Compromise","url":"https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise","by":"Socket","date":"2025-07-19"},{"kind":"news","title":"Popular npm linter packages hijacked via phishing to drop malware","url":"https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/","by":"BleepingComputer","date":"2025-07-19"},{"kind":"research","title":"eslint-config-prettier Hijack - Version 10.1.6 is Safe","url":"https://research.jfrog.com/post/eslint-config-prettier-hijack-10-1-6-safe/","by":"JFrog","date":"2025-07-24"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue: CVE-2025-54313","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-01-22"}],"started":"2026-01-22","closed":"2026-01-22","created":"2026-11-03T22:34:45.824Z","updated":"2026-11-03T22:34:45.824Z","cve_notes":[{"cve":"CVE-2025-54313","name":"Malware embedded in eslint-config-prettier releases","what":"Unauthorised eslint-config-prettier releases included an installation script that could launch bundled node-gyp.dll malware on Windows, allowing attacker-controlled code to run on the installing machine.","severity":"high","cvss":7.5}],"timeline":[{"at":"2026-01-22","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2025-54313 to its Known Exploited Vulnerabilities catalogue. Its entry identifies malware execution during package installation on Windows; ransomware involvement is unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-01-22","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"GitHub’s updated advisory lists clean replacement versions 8.10.2, 9.1.2 and 10.1.8 for eslint-config-prettier. Installing a clean package does not establish that a previously infected computer is clean.","url":"https://github.com/advisories/GHSA-f29h-pxvx-f335","by":"GitHub","patch":"patched"},{"at":"2025-07-24","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"JFrog disputed the inclusion of eslint-config-prettier 10.1.6 in the malware list: its analysis found altered package metadata but no malicious installation script or DLL. GitHub’s advisory continues to list that version as affected.","url":"https://research.jfrog.com/post/eslint-config-prettier-hijack-10-1-6-safe/","by":"JFrog","patch":null},{"at":"2025-07-19","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Socket reported that the stolen token had also been used to poison eslint-plugin-prettier, synckit, @pkgr/core and napi-postinstall. It advised developers to inspect their dependency records and reinstall clean packages.","url":"https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise","by":"Socket","patch":null},{"at":"2025-07-18","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"The maintainer prepared version 10.1.8 from the earlier repository code to replace the poisoned releases. This commit records the replacement version, rather than proving when npm made it available.","url":"https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385","by":"eslint-config-prettier maintainers","patch":null},{"at":"2025-07-18","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Developers reported unexpected eslint-config-prettier releases containing a Windows malware payload. Maintainer JounQin confirmed a phishing email had compromised his npm publishing token, revoked it and began marking the releases as deprecated.","url":"https://github.com/prettier/eslint-config-prettier/issues/339","by":"eslint-config-prettier maintainers","patch":null}],"url":"https://hard.fyi/live/eslint-config-prettier-malicious-releases-jul-2025/","json":"https://hard.fyi/api/live?id=eslint-config-prettier-malicious-releases-jul-2025"}