CVE-2025-54313

LLM-synthesized narrative grounded in this CVE's description and references.

Versions sourced from the GitHub Security Advisory.

• Alexghr/Got Fetch2 versions

  cpe:2.3:a:alexghr:got-fetch:5.1.1:*:*:*:*:node.js:*:*+ 1 more

  • cpe:2.3:a:alexghr:got-fetch:5.1.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:alexghr:got-fetch:5.1.2:*:*:*:*:node.js:*:*
• Homarr Labs/Homarr

  cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*

  Range: >=1.29.0,<1.30.0
• Prettier/Eslint Config Prettier5 versions

  cpe:2.3:a:prettier:eslint-config-prettier:10.1.6:*:*:*:*:node.js:*:*+ 4 more

  • cpe:2.3:a:prettier:eslint-config-prettier:10.1.6:*:*:*:*:node.js:*:*
  • cpe:2.3:a:prettier:eslint-config-prettier:10.1.7:*:*:*:*:node.js:*:*
  • cpe:2.3:a:prettier:eslint-config-prettier:8.10.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:prettier:eslint-config-prettier:9.1.1:*:*:*:*:node.js:*:*
  • (no CPE)range: 8.10.1
• Prettier/Eslint Plugin Prettier2 versions

  cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.2:*:*:*:*:node.js:*:*+ 1 more

  • cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.3:*:*:*:*:node.js:*:*
• Un Ts/Napi Postinstall

  cpe:2.3:a:un-ts:napi-postinstall:0.3.1:*:*:*:*:node.js:*:*
• Un Ts/Pkgr\/core

  cpe:2.3:a:un-ts:pkgr\/core:0.2.8:*:*:*:*:node.js:*:*
• Un Ts/Synckit

  cpe:2.3:a:un-ts:synckit:0.11.9:*:*:*:*:node.js:*:*
• ghsa-coords6 versions

  pkg:npm/%40pkgr/corepkg:npm/eslint-config-prettierpkg:npm/eslint-plugin-prettierpkg:npm/got-fetchpkg:npm/napi-postinstallpkg:npm/synckit

  >= 0.2.8, < 0.2.9+ 5 more

  • (no CPE)range: >= 0.2.8, < 0.2.9
  • (no CPE)range: >= 8.10.1, < 8.10.2
  • (no CPE)range: >= 4.2.2, < 4.2.4
  • (no CPE)range: >= 5.1.11, < 6.0.0
  • (no CPE)range: >= 0.3.1, < 0.3.2
  • (no CPE)range: >= 0.11.9, < 0.11.10

• www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/nvdExploitThird Party Advisory
• www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromisenvdExploitThird Party AdvisoryWEB
• github.com/advisories/GHSA-f29h-pxvx-f335ghsaADVISORY
• nvd.nist.gov/vuln/detail/CVE-2025-54313ghsaADVISORY
• socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromisenvdThird Party AdvisoryWEB
• www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-onlynvdThird Party AdvisoryWEB
• checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1ghsaWEB
• github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385ghsaWEB
• github.com/prettier/eslint-config-prettier/issues/339nvdIssue TrackingWEB
• github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854ghsaWEB
• github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9ghsaWEB
• github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1ddghsaWEB
• github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4ghsaWEB
• news.ycombinator.com/itemnvdIssue TrackingWEB
• news.ycombinator.com/itemnvdIssue TrackingWEB
• secure.software/npm/packages/got-fetchghsaWEB
• www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malwareghsaWEB
• www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government ResourceWEB
• www.npmjs.com/package/eslint-config-prettiernvdProductWEB

No linked articles in our index yet.