Malicious npm Package Update Compromises Developer Systems in eslint-config-prettier Supply Chain Attack

CyberDefender 7 mins0

CVE-2025-54313 is a supply chain compromise affecting the popular npm package eslint-config-prettier. Unlike traditional vulnerabilities caused by coding mistakes, this incident involved malicious code intentionally published into trusted package versions after an attacker compromised the maintainer’s npm credentials.

Because the package is widely used as a development dependency, the blast radius primarily impacts developer workstations, CI runners, and build environments, especially on Windows systems. This type of attack is particularly dangerous because it exploits trust rather than technical flaws.

Vulnerability Classification

  • Vulnerability Type: Supply chain compromise
  • CWE: CWE-506 – Embedded Malicious Code
  • Attack Vector: npm package installation
  • Execution Context: Post-install lifecycle hook
  • Platform Impact: Windows only
  • Severity: High (CVSS ~7.5)

Affected Package and Versions

Package: eslint-config-prettier

The following versions were confirmed to contain malicious code and should be treated as compromised artifacts, not just vulnerable software:

  • 8.10.1
  • 9.1.1
  • 10.1.6
  • 10.1.7

These versions were not accidentally flawed — they were deliberately weaponized and published by an attacker using stolen maintainer credentials.

Technical Breakdown of the Malicious Behavior

1. Post-Install Execution Abuse

The malicious versions introduced a post-install script (install.js) that automatically runs during:

npm install
yarn install
pnpm install

This script executes without user interaction, making it ideal for silent compromise.

2. Windows-Specific Payload Delivery

The malicious logic specifically checks for Windows environments and then:

  • Drops or loads a malicious DLL named node-gyp.dll
  • Executes it via Node.js process context
  • Achieves arbitrary code execution with the privileges of the installing user or CI agent

This design allowed the attacker to avoid detection on Linux/macOS systems while targeting Windows-heavy enterprise environments.

3. Why node-gyp.dll?

The filename was chosen intentionally:

  • node-gyp is a legitimate and common dependency
  • The name blends into normal Node.js build activity
  • Helps evade casual inspection and basic allowlists

This is a classic living-off-the-land naming technique adapted to the JavaScript ecosystem.

Attack Chain Summary

  1. Credential Theft
    • Maintainer credentials were stolen using phishing
    • npm token was exfiltrated
  2. Malicious Release
    • Attacker published new versions under the legitimate package name
    • Versions appeared normal in npm registry
  3. User Installation
    • Developers and CI systems installed the package as usual
    • Lockfiles silently pulled malicious versions
  4. Automatic Execution
    • Post-install script executed immediately
    • Malicious DLL loaded on Windows systems

Proof-of-Concept (High-Level, Educational Only)

⚠️ This section is for defensive understanding only.

The exploitation does not require special tooling:

  • Installing the affected package version on Windows is sufficient
  • No exploit payload needed — execution is automatic
  • The malicious DLL runs during install, not runtime

This highlights why supply chain attacks are so effective:
there is no exploit attempt to detect — only trusted behavior abused.

Detection Strategy (Technical)

1. Package & Dependency Detection

Immediate checks:

npm list eslint-config-prettier

Search lockfiles for known bad versions:

grep -E "8.10.1|9.1.1|10.1.6|10.1.7" package-lock.json yarn.lock pnpm-lock.yaml

2. Filesystem Indicators (Windows)

Look for unexpected DLLs in Node/npm paths:

node-gyp.dll

Common suspicious locations:

  • node_modules/.bin/
  • node_modules/eslint-config-prettier/
  • %TEMP%
  • CI workspace directories

3. Endpoint Detection (EDR / Sysmon-style)

Suspicious behavior patterns:

  • node.exe spawning DLL execution
  • DLL loads from node_modules directories
  • npm/yarn processes invoking native binaries

Example detection logic (pseudo-rule):

Process: node.exe
AND
Loaded Module endswith ".dll"
AND
Module Path contains "node_modules"
AND
OS = Windows

4. CI/CD Pipeline Detection

Flag pipelines where:

  • npm install runs on Windows runners
  • No dependency integrity verification is enforced
  • Lockfiles changed unexpectedly without dependency updates

Add monitoring for:

  • New post-install scripts
  • Unexpected filesystem writes during install stage

5. Network Indicators (Optional)

While payload behavior may vary, monitor for:

  • Outbound connections initiated during npm install
  • Node.js processes making network calls before build steps

Mitigation and Remediation

Immediate Actions

  1. Remove compromised versions
    • Delete affected packages
    • Clear node_modules and reinstall
  2. Rotate secrets
    • CI tokens
    • Developer credentials
    • npm auth tokens if exposed

Upgrade to Safe Versions (Official Patches)

Use only clean versions:

  • 8.10.2
  • 9.1.2
  • 10.1.8 or newer

Official package page (upgrade source):
https://www.npmjs.com/package/eslint-config-prettier

Hardening Recommendations

  • Enforce lockfile review
  • Enable npm package integrity verification
  • Prefer Linux-based CI runners
  • Monitor post-install scripts
  • Require MFA for npm maintainers
  • Restrict outbound network access during build stages

Risk Assessment

  • Primary risk: Developer machine compromise
  • Secondary risk: CI pipeline poisoning
  • Long-term risk: Downstream supply chain contamination

Even though this package is a dev dependency, compromise at this stage can lead to credential theft, source code tampering, and persistent access.

Final Summary

CVE-2025-54313 is a textbook example of a modern supply chain attack — no vulnerability scanning would catch it, no exploit payload is required, and trust is the only weakness exploited. The incident reinforces the reality that dependency management is now a security boundary, not just a development concern.

CyberDefender