erroneo.us
Search all guides⌘K

Security Digest · Jul 18, 2025 · Malicious package · Library

eslint-config-prettier Hijack: Scavenger Malware on npm

Phished maintainer's token pushed Windows malware in eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7 in July 2025. Now KEV. Purge caches, check hosts.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

The bad versions were live for a few hours in July 2025 and are gone from npm, so most teams only need to confirm no lockfile, mirror or Windows machine picked them up; any Windows host that installed one should be treated as compromised.

Who must act: Teams whose Windows laptops or Windows CI runners ran npm install on or after July 18, 2025 and resolved one of the listed versions, plus anyone with an npm proxy or cache that may still hold those tarballs.

Who can relax: Projects whose lockfiles never contained the listed versions, and Linux or macOS machines, where the install script does not launch the payload.

Affected
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7
eslint-plugin-prettier 4.2.2, 4.2.3
synckit 0.11.9
@pkgr/core 0.2.8
napi-postinstall 0.3.1
Fixed in
eslint-config-prettier 8.10.2, 9.1.2, 10.1.8
eslint-plugin-prettier 4.2.4
synckit 0.11.10
@pkgr/core 0.2.9
napi-postinstall 0.3.2
CVSS
7.5 (v3.1, CNA)
EPSS
5.1% (percentile 92)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Grep every lockfile and SBOM for the listed malicious versions.
  2. Purge those tarballs from Artifactory, Nexus, Verdaccio or other npm proxies and from local npm caches.
  3. Pin to the clean releases (for example eslint-config-prettier 10.1.8 or later) and regenerate lockfiles.
  4. Reimage any Windows machine or runner that installed a malicious version.
  5. From a clean machine, rotate the npm tokens, browser-saved passwords and sessions that a hit machine held.
  6. Run lint-only installs with --ignore-scripts where your tooling allows it.

How to check if you are affected or compromised

  • Search EDR telemetry for rundll32.exe loading node-gyp.dll (command line containing node-gyp.dll,main).
  • Look up CrowdStrike's SHA256 hashes for install.js, the Scavenger loader and the second-stage stealer.
  • Search DNS and proxy logs for firebase.su, dieorsuffer.com and smartscreen-api.com, and for the phishing domain npnjs.com.
  • Review July 2025 Dependabot and Renovate PRs that bumped these packages and the CI jobs that ran on them.

What happened#

On July 18, 2025, a user opened issue #339 on eslint-config-prettier. Four new versions had appeared on npm with no matching commits. About an hour later, the maintainer confirmed they had fallen for a phishing email and that an npm token had leaked. Socket traced the lure to the typosquatted domain npnjs.com. Using the token, the attacker published malicious releases of five packages the maintainer controlled, between 15:51 and 16:36 UTC per npm's publish times. The GitHub repositories were never touched.

The CVE record says installing an affected version "executes an install.js file that launches the node-gyp.dll malware on Windows." CrowdStrike named the DLL Scavenger. Its loader reads and exfiltrates the user's .npmrc, which often holds npm tokens. It then drops a second-stage infostealer that goes after browser data. The maintainer published clean versions within about three hours.

Who is affected#

The malicious versions, per GHSA-f29h-pxvx-f335, are:

  • eslint-config-prettier 8.10.1, 9.1.1, 10.1.6 and 10.1.7 (fixed in 8.10.2, 9.1.2 and 10.1.8)
  • eslint-plugin-prettier 4.2.2 and 4.2.3 (fixed in 4.2.4)
  • synckit 0.11.9 (fixed in 0.11.10)
  • @pkgr/core 0.2.8 (fixed in 0.2.9)
  • napi-postinstall 0.3.1 (fixed in 0.3.2)

The advisory also covers got-fetch 5.1.11 and 5.1.12. StepSecurity lists those plus is 3.3.1 and 5.0.0 from the same phishing wave. Only Windows runs the payload. StepSecurity also found Dependabot and Renovate PRs bumping projects to the bad releases, some of which were merged.

Do you really need to act?#

Briefly. None of the versions remain on the npm registry today, so a fresh install cannot fetch them. They can still come back from an internal npm proxy, an offline cache or a vendored node_modules. The real question is whether any Windows developer machine or CI runner installed one in July 2025. If so, assume npm tokens and browser credentials from that machine were stolen.

CISA added the CVE to KEV on January 22, 2026, six months after the incident, with a February 12 deadline. CISA has not said what exploitation prompted the listing. The Hacker News reports it was one of four entries CISA added that day, all citing evidence of active exploitation. For a later npm maintainer phishing attack, see our chalk and debug brief.

What to do now#

  1. Search lockfiles: grep -rEn '(eslint-config-prettier(@|@npm:|-)(8\.10\.1|9\.1\.1|10\.1\.[67])|eslint-plugin-prettier(@|@npm:|-)4\.2\.[23]|synckit(@|@npm:|-)0\.11\.9|pkgr/core(@|@npm:|/-/core-)0\.2\.8|napi-postinstall(@|@npm:|-)0\.3\.1)\b' --include='*lock*' .
  2. Delete those versions from your npm proxy and run npm cache clean --force on build hosts.
  3. Pin clean releases, for example npm install -D eslint-config-prettier@^10.1.8, and commit the new lockfile.
  4. Reimage any Windows host that installed a bad version. Then, from a clean machine, revoke its npm tokens (npm token list, npm token revoke <id>) and reset saved browser passwords and sessions.
  5. Use npm ci --ignore-scripts for lint-only CI jobs where that works.

How to tell if you were hit#

On Windows endpoints, hunt for rundll32.exe loading node-gyp.dll (CrowdStrike's query matches node-gyp.dll,main) from a node_modules path. Compare files against CrowdStrike's SHA256 hashes, which begin 32d0dbdf (install.js), c68e42f4 (loader) and 5bed3972 (stealer). Search DNS and proxy logs for firebase.su, dieorsuffer.com and smartscreen-api.com. Then review your npm account's tokens and recent publishes for anything you do not recognize.

Timeline#

  • — Malicious versions are published, issue #339 is opened, the maintainer confirms the phishing, and clean releases ship.
  • — CVE-2025-54313 and GHSA-f29h-pxvx-f335 are published.
  • — CrowdStrike publishes its Scavenger analysis and indicators.
  • — CISA adds CVE-2025-54313 to KEV.
  • — CISA's remediation deadline for federal agencies.

Vulnerability records

  • CVE-2025-54313 · KEV 2026-01-22 · eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. GitHub — eslint-config-prettier issue #339: four new versions published with no code changes github.com
  2. GitHub Advisory — GHSA-f29h-pxvx-f335 github.com
  3. CVE record — CVE-2025-54313 cve.org
  4. NVD — CVE-2025-54313 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2025-54313 cisa.gov
  6. StepSecurity — eslint-config-prettier package shows signs of compromise stepsecurity.io
  7. Socket — npm phishing campaign leads to Prettier tooling packages compromise socket.dev
  8. CrowdStrike — Falcon prevents supply chain attack involving compromised npm packages crowdstrike.com

Coverage and analysis

  1. The Hacker News — CISA updates KEV catalog with four actively exploited vulnerabilities thehackernews.com