Malicious Code in Prettier’s eslint-config-prettier (CVE-2025-54313) Enables Windows Malware Execution on Install

Critical Malicious Code in Prettier eslint-config-prettier (CVE‑2025‑54313) Enables Windows Malware Execution

What It Is – The npm package eslint-config-prettier published by Prettier contains an embedded install.js script that, when run on Windows, drops and executes a malicious node‑gyp.dll payload.

Exploitability – The malicious code runs automatically during a standard npm install of the affected version; no additional user interaction is required. Public advisories list the vulnerability as actively exploitable.

Affected Products – Prettier eslint-config-prettier (all versions prior to the patched release).

Why It Matters for Trust & Control Assurance

• Supply‑chain oversight – The flaw highlights the need for continuous monitoring of third‑party components that enter your codebase.
• Audit‑ready evidence – Demonstrating that you inventory, validate, and remediate open‑source dependencies satisfies multiple control objectives across frameworks (e.g., “manage external service providers” and “maintain secure configuration”).
• Defensible risk posture – Enterprises increasingly require proof that malicious code cannot be introduced via development tooling; this incident directly tests that assurance.

Recommended Actions

1. Immediately upgrade to the patched version of eslint-config-prettier or remove the package if not required.
2. Scan existing repositories and build artifacts for the node‑gyp.dll payload and any related indicators of compromise.
3. Implement a Software Bill of Materials (SBOM) and automated dependency scanning to detect future malicious inserts.
4. Document the remediation steps in your change‑management system to provide audit evidence.

Source: CISA KEV – CVE‑2025‑54313