Executive brief
A popular software development tool used for code formatting has been compromised with malicious code. When developers install the affected versions of this tool on Windows systems, it automatically executes a hidden script that installs malware. This supply chain attack could allow unauthorized access to developer workstations and sensitive corporate source code.
Technical details
This is a supply chain compromise involving the embedding of malicious code (CWE-506) within several popular NPM packages, most notably eslint-config-prettier. The vulnerability is triggered during the package installation process via a malicious 'install.js' script. On Windows environments, this script executes a malicious DLL named 'node-gyp.dll'. The attack does not require authentication and is being exploited in the wild. Users should immediately audit their dependency trees and revert to known-good versions or apply vendor-provided patches.
Affected products
- Prettier eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7
- Prettier eslint-plugin-prettier 4.2.2, 4.2.3
- alexghr got-fetch 5.1.1, 5.1.2
- homarr homarr 1.29.0 to 1.30.0
- un-ts napi-postinstall 0.3.1
- un-ts pkgr/core 0.2.8
- un-ts synckit 0.11.9
Timeline
- 2025-07-23: other: Initial CVE modification recorded
- 2026-01-22: disclosed: Vulnerability details published
- 2026-01-22: kev added: Added to CISA Known Exploited Vulnerabilities catalog