PoC Index

CVE-2025-54313

KEVHIGH 7.5EPSS 4.3%

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

CVSS v3.1
7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS v3.1
7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
EPSS
4.35% chance of exploitation in the next 30 days, 91th percentile
CISA KEV
added 2026-01-22
Published
2025-07-19
Updated
2026-02-26

Proof-of-concept exploits (1)

References

Related