eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Loading...
Loading...
Score elevated to 9.0 because this CVE is listed on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-22), indicating real-world exploitation has been confirmed by US federal agencies. NVD baseline CVSS 7.5 retained for reference. Confidence: HIGH.
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
July 19, 2025
January 23, 2026
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| eslint-config-prettier | 8.10.1 | 8.10.2 | — |
| eslint-plugin-prettier | — | 4.2.4 | — |
| got-fetch | — | 6.0.0 | — |
| napi-postinstall | 0.3.1 | 0.3.2 | — |
| @pkgr/core | 0.2.8 | 0.2.9 | — |
| synckit | 0.11.9 | 0.11.10 | — |
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
See which npm, PyPI, Go, and Maven packages are affected by CVE-2025-54313
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.