VYPR
Get started
← All advisories
High severityCISA KEVNVD Advisory· Published Jul 19, 2025· Updated Feb 26, 2026

CVE-2025-54313

CVE-2025-54313

Description

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
eslint-config-prettiernpm
>= 8.10.1, < 8.10.28.10.2
eslint-config-prettiernpm
>= 9.1.1, < 9.1.29.1.2
eslint-config-prettiernpm
>= 10.1.6, < 10.1.810.1.8
eslint-plugin-prettiernpm
>= 4.2.2, < 4.2.44.2.4
synckitnpm
>= 0.11.9, < 0.11.100.11.10
@pkgr/corenpm
>= 0.2.8, < 0.2.90.2.9
napi-postinstallnpm
>= 0.3.1, < 0.3.20.3.2
got-fetchnpm
>= 5.1.11, < 6.0.06.0.0

Affected products

1
  • prettier/eslint-config-prettierv5
    Range: 8.10.1

Patches

5
ec39dd4400f1

fix: release a new v4 version

https://github.com/prettier/eslint-plugin-prettierJounQinJul 18, 2025via ghsa
commit
3 files changed · +13 −5
  • .changeset/config.json+1 −1 modified
    @@ -9,7 +9,7 @@
   "commit": false,
   "linked": [],
   "access": "public",
-  "baseBranch": "master",
+  "baseBranch": "release-v4",
   "updateInternalDependencies": "patch",
   "ignore": []
 }
  • .github/workflows/release.yml+11 −3 modified
    @@ -3,7 +3,12 @@ name: Release
 on:
   push:
     branches:
-      - master
+      - release-v4
+
+permissions:
+  contents: write
+  id-token: write
+  pull-requests: write
 
 jobs:
   release:
@@ -26,7 +31,10 @@ jobs:
         id: changesets
         uses: changesets/action@v1
         with:
-          commit: 'chore: release prettier-plugin-svelte'
-          title: 'chore: release prettier-plugin-svelte'
+          commit: 'chore: release eslint-plugin-prettier'
+          title: 'chore: release eslint-plugin-prettier'
+          publish: yarn release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  • package.json+1 −1 modified
    @@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-prettier",
-  "version": "4.2.1",
+  "version": "4.2.4",
   "description": "Runs prettier as an eslint rule",
   "repository": "git+https://github.com/prettier/eslint-plugin-prettier.git",
   "homepage": "https://github.com/prettier/eslint-plugin-prettier#readme",
8f2ee32d4f75

fix: release a new latest version

https://github.com/un-ts/synckitJounQinJul 18, 2025via ghsa
commit
1 file changed · +1 −1
  • package.json+1 −1 modified
    @@ -1,6 +1,6 @@
 {
   "name": "synckit",
-  "version": "0.11.9",
+  "version": "0.11.10",
   "type": "module",
   "description": "Perform async work synchronously in Node.js using `worker_threads` with first-class TypeScript support.",
   "repository": "https://github.com/un-ts/synckit.git",
38b4e95cf554

fix: release a new latest version

https://github.com/un-ts/napi-postinstallJounQinJul 18, 2025via ghsa
commit
1 file changed · +1 −1
  • package.json+1 −1 modified
    @@ -1,6 +1,6 @@
 {
   "name": "napi-postinstall",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "type": "commonjs",
   "description": "The `postinstall` script helper for handling native bindings in legacy `npm` versions",
   "repository": "git+https://github.com/un-ts/napi-postinstall.git",
e1420c99e44d

fix: release a new release-0.2 version

https://github.com/un-ts/pkgrJounQinJul 18, 2025via ghsa
commit
1 file changed · +1 −1
  • packages/core/package.json+1 −1 modified
    @@ -1,6 +1,6 @@
 {
   "name": "@pkgr/core",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "type": "module",
   "description": "Shared core module for `@pkgr` packages or any package else",
   "repository": "git+https://github.com/un-ts/pkgr.git",
9b0b0a47ec28

fix: release a new latest version

https://github.com/prettier/eslint-config-prettierJounQinJul 18, 2025via ghsa
commit
1 file changed · +1 −1
  • package.json+1 −1 modified
    @@ -1,6 +1,6 @@
 {
   "name": "eslint-config-prettier",
-  "version": "10.1.5",
+  "version": "10.1.8",
   "type": "commonjs",
   "description": "Turns off all rules that are unnecessary or might conflict with Prettier.",
   "repository": "prettier/eslint-config-prettier",

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

19

News mentions

0

No linked articles in our index yet.