Supply Chain Compromise in eslint-config-prettier Affects Multiple Versions

CVE-2025-54313

What is CVE-2025-54313?

The eslint-config-prettier package has been compromised, with malicious code embedded in versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7. The compromised install.js file executes when the package is installed, resulting in the activation of node-gyp.dll malware on Windows systems. This incident highlights the importance of supply chain security, emphasizing the risks associated with using third-party libraries in development workflows.

References