CVE-2025-54313: 
JavaScript vulnerability analysis and mitigation

CVE-2025-54313 affects eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7, which were compromised in a supply chain attack on July 18, 2025. The attack occurred after a maintainer's npm token was stolen through a phishing campaign using a spoofed npmjs.com login page. The compromised versions contained malicious code that executes during package installation on Windows systems (Socket Blog, BleepingComputer).

The malicious versions include an install.js script that executes during package installation, which attempts to load a malicious DLL (node-gyp.dll) via rundll32 on Windows systems. The attack specifically targets Windows machines and exits immediately on other platforms. The vulnerability has been assigned a CVSS score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N (Endor Labs).

The compromised package, which has over 30 million weekly downloads, could potentially affect Windows developers and CI/CD systems that installed the malicious versions. The attack primarily impacts development environments rather than production systems, as eslint-config-prettier is typically used as a development dependency (Socket Blog, BleepingComputer).

The affected versions have been deprecated on the npm registry, and clean versions have been published. Users should immediately pin their dependencies to safe versions (8.10.2+, 9.1.2+, 10.1.8+). Organizations should review their package-lock.json or yarn.lock files for references to compromised versions, audit CI/CD logs for unusual activity if affected versions were installed, and rotate any secrets that may have been exposed during affected build processes (Endor Labs).

The security community responded quickly to the incident, with researchers and developers collaborating to identify and analyze the compromise. The package maintainer, JounQin, acknowledged falling victim to the phishing attack and took swift action to deprecate the malicious versions. The incident has sparked discussions about the need for better security practices in the npm ecosystem, particularly around maintainer account security and automated dependency updates (StepSecurity).