NewsCompaniesFlawsGuides
Get the app
HighFixedClosedUpdated

Poisoned eslint-config-prettier releases delivered Windows malware (CVE-2025-54313)

A stolen maintainer token let attackers publish poisoned eslint-config-prettier releases in July 2025. CISA confirmed exploitation in January 2026. Developers should install clean replacements and investigate Windows machines that installed affected versions.

What to do

Nothing for you to do unless you or your IT team develops software using these packages. Ask developers to replace affected eslint-config-prettier releases with 8.10.2, 9.1.2 or 10.1.8 on the corresponding release line, and check related dependencies. Windows machines that installed poisoned packages need investigation, including replacement of any credentials that may have been exposed.

What’s happening

This software supply-chain attack began in July 2025, when phishing exposed a maintainer’s npm publishing token. Attackers used it to publish unauthorised versions of eslint-config-prettier, a tool developers use to prevent conflicts between ESLint and Prettier formatting rules. Installing poisoned releases could launch bundled malware on Windows developer computers or build machines. The maintainer revoked the token and deprecated the suspect releases; clean replacements are available for all three affected release lines. Related packages were also compromised. There is one unresolved reporting difference: GitHub lists 10.1.6 as affected, while JFrog says that release contained altered metadata but lacked the malware script and payload. CISA added CVE-2025-54313 to its exploited-vulnerability catalogue on 22 January 2026. As at 3 November 2026, the reviewed sources do not establish whether attacks are continuing. Replacing the dependency does not by itself remove malware or undo credential exposure.

What
Poisoned software
Affects
eslint-config-prettier npm package
Affected
eslint-config-prettier 8.10.1
eslint-config-prettier 9.1.1
eslint-config-prettier 10.1.6 and 10.1.7; GitHub lists both, but JFrog reports that 10.1.6 lacks the malware payload
Fixed in
eslint-config-prettier 8.10.2
eslint-config-prettier 9.1.2
eslint-config-prettier 10.1.8
CVE
CVE-2025-54313
Since
22 Jan 2026
Closed
22 Jan 2026

Timeline

  1. CISA added

    CISA added CVE-2025-54313 to its Known Exploited Vulnerabilities catalogue. Its entry identifies malware execution during package installation on Windows; ransomware involvement is unknown.

  2. UpdateFixed

    GitHub’s updated advisory lists clean replacement versions 8.10.2, 9.1.2 and 10.1.8 for eslint-config-prettier. Installing a clean package does not establish that a previously infected computer is clean.

  3. Update

    JFrog disputed the inclusion of eslint-config-prettier 10.1.6 in the malware list: its analysis found altered package metadata but no malicious installation script or DLL. GitHub’s advisory continues to list that version as affected.

  4. Update

    Socket reported that the stolen token had also been used to poison eslint-plugin-prettier, synckit, @pkgr/core and napi-postinstall. It advised developers to inspect their dependency records and reinstall clean packages.

  5. Update

    The maintainer prepared version 10.1.8 from the earlier repository code to replace the poisoned releases. This commit records the replacement version, rather than proving when npm made it available.

  6. Made public

    Developers reported unexpected eslint-config-prettier releases containing a Windows malware payload. Maintainer JounQin confirmed a phishing email had compromised his npm publishing token, revoked it and began marking the releases as deprecated.

Sources

  1. Maintainer confirmation and response: four new versions published with no code changes to repoeslint-config-prettier maintainers · 18 July 2025
  2. fix: release a new latest versioneslint-config-prettier maintainers · 18 July 2025
  3. CVE-2025-54313: embedded malicious code in npm packagesGitHub · 22 Jan 2026
  4. Active Supply Chain Attack: npm Phishing Campaign Leads to Prettier Tooling Packages CompromiseSocket · 19 July 2025
  5. Popular npm linter packages hijacked via phishing to drop malwareBleepingComputer · 19 July 2025
  6. eslint-config-prettier Hijack - Version 10.1.6 is SafeJFrog · 24 July 2025
  7. Known Exploited Vulnerabilities catalogue: CVE-2025-54313CISA · 22 Jan 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from January 2026 · JSON · RSS