eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Multiple nodejs packages were embedded with malicious code. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. The following nodejs packages and versions are affected:

  - @pkgr/core 0.2.8
  - eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7
  - eslint-plugin-prettier 4.2.2, 4.2.3
  - got-fetch 5.1.11, 5.1.12
  - napi-postinstall 0.3.1
  - synckit 0.11.9

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain
    compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll
    malware on Windows. (CVE-2025-54313)

ID	Name	Product	Family	Severity
245592	Node.js Multiple Packages Embedded Malicious Code (CVE-2025-54313)	Nessus	Windows	high
428609	SCA: security update for @pkgr/core, eslint-config-prettier, eslint-plugin-prettier, got-fetch, napi-postinstall, synckit (GHSA-f29h-pxvx-f335)	Tenable Cloud Security	SCA Checks	high
428609	SCA: security update for @pkgr/core, eslint-config-prettier, eslint-plugin-prettier, got-fetch, napi-postinstall, synckit (GHSA-f29h-pxvx-f335)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-54313

high

Tenable Plugins

high

high

high