ClosedPatched

eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)

npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is

A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.

Why this severity: Supply-chain compromise; Windows infostealer

Started: Jul 18, 2025
Closed: Jul 22, 2025
CVE: CVE-2025-54313

Follow this incident

Updated Jul 22, 2025

Affected

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7
is 3.3.1, 5.0.0

Fixed in

Malicious versions removed; use other eslint-config-prettier versions (see CVE record)

Timeline2

Jul 22, 2025
Malicious 'is' package versions found in the same campaign
Source
Jul 18, 2025
Malicious eslint-config-prettier versions published after maintainer phishing
Source

Advisories2

News & write-ups3

Notes & caveats

The 'is' date (2025-07-22) is approximate from Socket's post; verify there.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified