CVE-2025-54313: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

CVE-2025-54313 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-07-19

A popular software development tool used for code formatting has been compromised with malicious code. When developers install the affected versions of this tool on Windows systems, it automatically executes a hidden script that installs malware. This supply chain attack could allow unauthorized access to developer workstations and sensitive corporate source code.

Technologies: Homarr. Vendors: Homarr, npm.

Quick answers

Is CVE-2025-54313 exploited in the wild?
Yes. CVE-2025-54313 is known to be exploited in the wild, first recorded on 22 January 2026. Treat it as urgent.
How severe is CVE-2025-54313?
Critical severity, with a CVSS score of 3.1, published 19 July 2025.
Which products and versions are affected?
Alexghr Got-Fetch 5.1.1, 5.1.2; Homarr 1.29.0 to 1.30.0; got-fetch (npm) SEMVER:introduced=5.1.11,fixed=6.0.0; Prettier Eslint-Config-Prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7; and 9 more.
Is there a fix for CVE-2025-54313?
Yes. got-fetch (npm): upgrade to 6.0.0 or later; @Pkgr/Core: upgrade to 0.2.9 or later; Eslint-Config-Prettier: upgrade to 8.10.2 or later; Eslint-Plugin-Prettier: upgrade to 4.2.4 or later; Napi-Postinstall: upgrade to 0.3.2 or later; Synckit: upgrade to 0.11.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54313 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-54313?
Check whether you run Alexghr Got-Fetch, Homarr, got-fetch (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • got-fetch (npm): upgrade to 6.0.0 or later
    npm install got-fetch@6.0.0
  • @Pkgr/Core: upgrade to 0.2.9 or later
  • Eslint-Config-Prettier: upgrade to 8.10.2 or later
  • Eslint-Plugin-Prettier: upgrade to 4.2.4 or later
  • Napi-Postinstall: upgrade to 0.3.2 or later
  • Synckit: upgrade to 0.11.10 or later

Technical details

This is a supply chain compromise involving the embedding of malicious code (CWE-506) within several popular NPM packages, most notably eslint-config-prettier. The vulnerability is triggered during the package installation process via a malicious 'install.js' script. On Windows environments, this script executes a malicious DLL named 'node-gyp.dll'. The attack does not require authentication and is being exploited in the wild. Users should immediately audit their dependency trees and revert to known-good versions or apply vendor-provided patches.

Affected products

  • Prettier eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7
  • Prettier eslint-plugin-prettier 4.2.2, 4.2.3
  • alexghr got-fetch 5.1.1, 5.1.2
  • homarr homarr 1.29.0 to 1.30.0
  • un-ts napi-postinstall 0.3.1
  • un-ts pkgr/core 0.2.8
  • un-ts synckit 0.11.9

Identifiers

  • CVE-2025-54313
  • GHSA-f29h-pxvx-f335

Timeline

  • 2025-07-23: other: Initial CVE modification recorded
  • 2026-01-22: disclosed: Vulnerability details published
  • 2026-01-22: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.