CVE-2025-54313: 
JavaScript vulnerability analysis and mitigation

CVE-2025-54313 is an embedded malicious code (CWE-506) supply chain vulnerability affecting several popular npm packages, most notably eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7. Additional affected packages include eslint-plugin-prettier (4.2.2, 4.2.3), synckit (0.11.9), @pkgr/core (0.2.8), napi-postinstall (0.3.1), and got-fetch (5.1.1, 5.1.2). The compromise was first detected on July 18, 2025, when developers noticed npm versions with no corresponding GitHub repository changes; the CVE was published on July 19, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, CISA KEV).

The root cause is a targeted phishing attack against the npm package maintainer (JounQin), who received a spoofed email from a fake npnjs[.]com domain impersonating npm support, leading to theft of his npm publish token (BleepingComputer). The attacker used the stolen credentials to publish unauthorized package versions containing a malicious npm postinstall script (install.js). This script includes a deceptively named function logDiskSpace() that, rather than monitoring disk space, executes a bundled Windows DLL (node-gyp.dll) via the rundll32 system process — delivering a trojan with a 19/72 VirusTotal detection rate at time of discovery (BleepingComputer, GitHub Advisory). The attack is Windows-specific; non-Windows systems are not affected by the DLL execution stage.

Successful exploitation results in execution of the node-gyp.dll trojan on Windows developer machines and CI/CD build environments during package installation, enabling remote code execution (RCE), data exfiltration, and potential lateral movement within development networks (CISA KEV). Any secrets, credentials, or tokens present in the build environment at the time of installation may be exposed. Downstream software products built using these infected dependencies are also at risk, and Homarr versions 1.29.0 through 1.30.0 were confirmed affected as a downstream consumer (GitHub ProxmoxVE Discussion). The Scavenger malware family has been associated with weaponization of this vulnerability (Feedly).

CVE-2025-54313 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on January 22, 2026, with a remediation due date of February 12, 2026 (CISA KEV). Public proof-of-concept and analysis tools are available, including a scanner on GitHub (GitHub PoC) and a CVE-specific repository (GitHub PoC). The EPSS score is approximately 12.5% (94th percentile) per the GitHub Advisory Database, indicating a high relative probability of exploitation (GitHub Advisory). The Scavenger malware family has been linked to exploitation of this vulnerability (Feedly).

1. Phishing the maintainer: The attacker sent a spoofed email appearing to originate from support@npmjs.com, directing the maintainer to a fake npnjs[.]com domain to "verify" their account, harvesting their npm publish token (BleepingComputer).
2. Publishing malicious versions: Using the stolen token, the attacker published unauthorized versions of eslint-config-prettier (8.10.1, 9.1.1, 10.1.6, 10.1.7) and related packages to the npm registry, with no corresponding commits in the GitHub repository.
3. Embedding the postinstall hook: The malicious versions include an install.js file registered as an npm postinstall script, which executes automatically when any developer or CI/CD pipeline runs npm install on an affected package version.
4. DLL execution on Windows: The install.js script calls a function named logDiskSpace() that invokes rundll32.exe to execute the bundled node-gyp.dll trojan, achieving code execution on the victim's Windows machine (BleepingComputer).
5. Post-exploitation: The node-gyp.dll malware (associated with the Scavenger family) can perform data exfiltration, credential theft, and enable lateral movement within the developer's environment or CI/CD pipeline.

• Network: Unexpected outbound connections from developer machines or CI/CD runners to unknown external IPs following an npm install operation; DNS queries to suspicious domains from Node.js or rundll32.exe processes.
• File System: Presence of node-gyp.dll or crashreporter.dll in npm package directories (e.g., node_modules/eslint-config-prettier/); unexpected DLL files in npm cache or temp directories.
• Process: rundll32.exe spawned as a child process of node.exe or npm.exe during package installation; unusual child processes (e.g., cmd.exe, powershell.exe) launched from Node.js.
• Logs: npm install logs referencing install.js execution in affected package versions (8.10.1, 9.1.1, 10.1.6, 10.1.7 of eslint-config-prettier); CI/CD build logs showing postinstall script execution for affected packages.
• Package Lock Files: References to affected versions (eslint-config-prettier@8.10.1, 9.1.1, 10.1.6, or 10.1.7; eslint-plugin-prettier@4.2.2 or 4.2.3; synckit@0.11.9; @pkgr/core@0.2.8; napi-postinstall@0.3.1; got-fetch@5.1.1 or 5.1.2) in package-lock.json, yarn.lock, pnpm-lock.yaml, or bun.lock (BleepingComputer, GitHub Advisory).

Immediately audit lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock) for references to any affected versions and upgrade to patched releases: eslint-config-prettier ≥ 8.10.2 / 9.1.2 / 10.1.8; eslint-plugin-prettier ≥ 4.2.4; synckit ≥ 0.11.10; @pkgr/core ≥ 0.2.9; napi-postinstall ≥ 0.3.2; got-fetch ≥ 6.0.0 (GitHub Advisory). If builds were deployed after July 18, 2025, inspect CI logs and runtime environments for signs of compromise, especially on Windows, and rotate any secrets or tokens that may have been exposed. Implement npm package integrity verification, consider pinning dependencies to known-good versions, and use private registries with security scanning. For Windows systems that may have executed the malware, run thorough security scans and monitor for suspicious rundll32.exe activity (CISA KEV, BleepingComputer).

The compromise was first publicly flagged by developer Dasa Paddock in a GitHub issue noting that new npm versions had no corresponding repository changes, prompting rapid community response (GitHub Issue #339). Maintainer JounQin publicly confirmed the phishing attack and apologized, immediately revoking the stolen token and publishing clean versions. The incident generated significant discussion on Hacker News and security-focused social media, with researchers highlighting the fragility of npm supply chain trust. CrowdStrike published a blog post on how their Falcon platform prevents such npm supply chain attacks, and StepSecurity issued a detailed supply chain security alert (StepSecurity, CrowdStrike). CISA's addition to the KEV catalog in January 2026 drew widespread media coverage from BleepingComputer, The Hacker News, Security Affairs, and others.