---
title: "eslint-config-prettier Hijack: Scavenger Malware on npm"
url: https://erroneo.us/security/briefs/eslint-config-prettier-npm-phishing-scavenger-kev/
description: "Phished maintainer's token pushed Windows malware in eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7 in July 2025. Now KEV. Purge caches, check hosts."
type: security-brief
section: "Security Digest"
date_published: 2025-07-18
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-54313"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# eslint-config-prettier Hijack: Scavenger Malware on npm

**Verdict: Check exposure.** The bad versions were live for a few hours in July 2025 and are gone from npm, so most teams only need to confirm no lockfile, mirror or Windows machine picked them up; any Windows host that installed one should be treated as compromised.

- **Who must act:** Teams whose Windows laptops or Windows CI runners ran npm install on or after July 18, 2025 and resolved one of the listed versions, plus anyone with an npm proxy or cache that may still hold those tarballs.
- **Who can relax:** Projects whose lockfiles never contained the listed versions, and Linux or macOS machines, where the install script does not launch the payload.
- **Affected:** eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7; eslint-plugin-prettier 4.2.2, 4.2.3; synckit 0.11.9; @pkgr/core 0.2.8; napi-postinstall 0.3.1
- **Fixed:** eslint-config-prettier 8.10.2, 9.1.2, 10.1.8; eslint-plugin-prettier 4.2.4; synckit 0.11.10; @pkgr/core 0.2.9; napi-postinstall 0.3.2
- **CVEs:** CVE-2025-54313
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Grep every lockfile and SBOM for the listed malicious versions.
2. Purge those tarballs from Artifactory, Nexus, Verdaccio or other npm proxies and from local npm caches.
3. Pin to the clean releases (for example eslint-config-prettier 10.1.8 or later) and regenerate lockfiles.
4. Reimage any Windows machine or runner that installed a malicious version.
5. From a clean machine, rotate the npm tokens, browser-saved passwords and sessions that a hit machine held.
6. Run lint-only installs with --ignore-scripts where your tooling allows it.

### How to check if you are affected

- Search EDR telemetry for rundll32.exe loading node-gyp.dll (command line containing node-gyp.dll,main).
- Look up CrowdStrike's SHA256 hashes for install.js, the Scavenger loader and the second-stage stealer.
- Search DNS and proxy logs for firebase.su, dieorsuffer.com and smartscreen-api.com, and for the phishing domain npnjs.com.
- Review July 2025 Dependabot and Renovate PRs that bumped these packages and the CI jobs that ran on them.

## What happened

On July 18, 2025, a user opened [issue #339](https://github.com/prettier/eslint-config-prettier/issues/339) on eslint-config-prettier. Four new versions had appeared on npm with no matching commits. About an hour later, the maintainer confirmed they had fallen for a phishing email and that an npm token had leaked. [Socket](https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise) traced the lure to the typosquatted domain npnjs.com. Using the token, the attacker published malicious releases of five packages the maintainer controlled, between 15:51 and 16:36 UTC per npm's publish times. The GitHub repositories were never touched.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-54313) says installing an affected version "executes an install.js file that launches the node-gyp.dll malware on Windows." [CrowdStrike](https://www.crowdstrike.com/en-us/blog/crowdstrike-falcon-prevents-npm-package-supply-chain-attacks/) named the DLL Scavenger. Its loader reads and exfiltrates the user's `.npmrc`, which often holds npm tokens. It then drops a second-stage infostealer that goes after browser data. The maintainer published clean versions within about three hours.

## Who is affected

The malicious versions, per [GHSA-f29h-pxvx-f335](https://github.com/advisories/GHSA-f29h-pxvx-f335), are:

- eslint-config-prettier 8.10.1, 9.1.1, 10.1.6 and 10.1.7 (fixed in 8.10.2, 9.1.2 and 10.1.8)
- eslint-plugin-prettier 4.2.2 and 4.2.3 (fixed in 4.2.4)
- synckit 0.11.9 (fixed in 0.11.10)
- @pkgr/core 0.2.8 (fixed in 0.2.9)
- napi-postinstall 0.3.1 (fixed in 0.3.2)

The advisory also covers got-fetch 5.1.11 and 5.1.12. [StepSecurity](https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise) lists those plus `is` 3.3.1 and 5.0.0 from the same phishing wave. Only Windows runs the payload. StepSecurity also found Dependabot and Renovate PRs bumping projects to the bad releases, some of which were merged.

## Do you really need to act?

Briefly. None of the versions remain on the npm registry today, so a fresh install cannot fetch them. They can still come back from an internal npm proxy, an offline cache or a vendored `node_modules`. The real question is whether any Windows developer machine or CI runner installed one in July 2025. If so, assume npm tokens and browser credentials from that machine were stolen.

CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313) on January 22, 2026, six months after the incident, with a February 12 deadline. CISA has not said what exploitation prompted the listing. [The Hacker News](https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html) reports it was one of four entries CISA added that day, all citing evidence of active exploitation. For a later npm maintainer phishing attack, see our [chalk and debug brief](https://erroneo.us/security/briefs/chalk-debug-npm-qix-phishing-hijack/).

## What to do now

1. Search lockfiles: `grep -rEn '(eslint-config-prettier(@|@npm:|-)(8\.10\.1|9\.1\.1|10\.1\.[67])|eslint-plugin-prettier(@|@npm:|-)4\.2\.[23]|synckit(@|@npm:|-)0\.11\.9|pkgr/core(@|@npm:|/-/core-)0\.2\.8|napi-postinstall(@|@npm:|-)0\.3\.1)\b' --include='*lock*' .`
2. Delete those versions from your npm proxy and run `npm cache clean --force` on build hosts.
3. Pin clean releases, for example `npm install -D eslint-config-prettier@^10.1.8`, and commit the new lockfile.
4. Reimage any Windows host that installed a bad version. Then, from a clean machine, revoke its npm tokens (`npm token list`, `npm token revoke <id>`) and reset saved browser passwords and sessions.
5. Use `npm ci --ignore-scripts` for lint-only CI jobs where that works.

## How to tell if you were hit

On Windows endpoints, hunt for `rundll32.exe` loading `node-gyp.dll` (CrowdStrike's query matches `node-gyp.dll,main`) from a `node_modules` path. Compare files against CrowdStrike's SHA256 hashes, which begin `32d0dbdf` (`install.js`), `c68e42f4` (loader) and `5bed3972` (stealer). Search DNS and proxy logs for `firebase.su`, `dieorsuffer.com` and `smartscreen-api.com`. Then review your npm account's tokens and recent publishes for anything you do not recognize.

## Timeline

- Jul 18, 2025 — Malicious versions are published, issue #339 is opened, the maintainer confirms the phishing, and clean releases ship.
- Jul 19, 2025 — CVE-2025-54313 and GHSA-f29h-pxvx-f335 are published.
- Jul 23, 2025 — CrowdStrike publishes its Scavenger analysis and indicators.
- Jan 22, 2026 — CISA adds CVE-2025-54313 to KEV.
- Feb 12, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [GitHub — eslint-config-prettier issue #339: four new versions published with no code changes](https://github.com/prettier/eslint-config-prettier/issues/339)
2. [GitHub Advisory — GHSA-f29h-pxvx-f335](https://github.com/advisories/GHSA-f29h-pxvx-f335)
3. [CVE record — CVE-2025-54313](https://www.cve.org/CVERecord?id=CVE-2025-54313)
4. [NVD — CVE-2025-54313](https://nvd.nist.gov/vuln/detail/CVE-2025-54313)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-54313](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313)
6. [StepSecurity — eslint-config-prettier package shows signs of compromise](https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise)
7. [Socket — npm phishing campaign leads to Prettier tooling packages compromise](https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise)
8. [CrowdStrike — Falcon prevents supply chain attack involving compromised npm packages](https://www.crowdstrike.com/en-us/blog/crowdstrike-falcon-prevents-npm-package-supply-chain-attacks/)
9. [The Hacker News — CISA updates KEV catalog with four actively exploited vulnerabilities](https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html)

---
Source page: https://erroneo.us/security/briefs/eslint-config-prettier-npm-phishing-scavenger-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt