Critical Malicious Code in Prettier eslint-config-prettier (CVE‑2025‑54313) Enables Windows Malware Execution
What It Is – The npm package eslint-config-prettier published by Prettier contains an embedded install.js script that, when run on Windows, drops and executes a malicious node‑gyp.dll payload.
Exploitability – The malicious code runs automatically during a standard npm install of the affected version; no additional user interaction is required. Public advisories list the vulnerability as actively exploitable.
Affected Products – Prettier eslint-config-prettier (all versions prior to the patched release).
Why It Matters for Trust & Control Assurance
- Supply‑chain oversight – The flaw highlights the need for continuous monitoring of third‑party components that enter your codebase.
- Audit‑ready evidence – Demonstrating that you inventory, validate, and remediate open‑source dependencies satisfies multiple control objectives across frameworks (e.g., “manage external service providers” and “maintain secure configuration”).
- Defensible risk posture – Enterprises increasingly require proof that malicious code cannot be introduced via development tooling; this incident directly tests that assurance.
Recommended Actions
- Immediately upgrade to the patched version of
eslint-config-prettieror remove the package if not required. - Scan existing repositories and build artifacts for the
node‑gyp.dllpayload and any related indicators of compromise. - Implement a Software Bill of Materials (SBOM) and automated dependency scanning to detect future malicious inserts.
- Document the remediation steps in your change‑management system to provide audit evidence.
Source: CISA KEV – CVE‑2025‑54313