# CVE-2025-54313: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

Source: https://junglewise.ai/threats/cve-2025-54313-prettier-eslint-config-prettier-embedded-malicious-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-19. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-54313 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-07-19

A popular software development tool used for code formatting has been compromised with malicious code. When developers install the affected versions of this tool on Windows systems, it automatically executes a hidden script that installs malware. This supply chain attack could allow unauthorized access to developer workstations and sensitive corporate source code.

Technologies: [Homarr](https://junglewise.ai/threats/technologies/homarr). Vendors: [Homarr](https://junglewise.ai/threats/vendors/homarr), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-54313 exploited in the wild?** Yes. CVE-2025-54313 is known to be exploited in the wild, first recorded on 22 January 2026. Treat it as urgent.

**How severe is CVE-2025-54313?** Critical severity, with a CVSS score of 3.1, published 19 July 2025.

**Which products and versions are affected?** Alexghr Got-Fetch 5.1.1, 5.1.2; Homarr 1.29.0 to 1.30.0; got-fetch (npm) SEMVER:introduced=5.1.11,fixed=6.0.0; Prettier Eslint-Config-Prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7; and 9 more.

**Is there a fix for CVE-2025-54313?** Yes. got-fetch (npm): upgrade to 6.0.0 or later; @Pkgr/Core: upgrade to 0.2.9 or later; Eslint-Config-Prettier: upgrade to 8.10.2 or later; Eslint-Plugin-Prettier: upgrade to 4.2.4 or later; Napi-Postinstall: upgrade to 0.3.2 or later; Synckit: upgrade to 0.11.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-54313 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-54313?** Check whether you run Alexghr Got-Fetch, Homarr, got-fetch (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- got-fetch (npm): upgrade to 6.0.0 or later

  ```sh
  npm install got-fetch@6.0.0
  ```

- @Pkgr/Core: upgrade to 0.2.9 or later
- Eslint-Config-Prettier: upgrade to 8.10.2 or later
- Eslint-Plugin-Prettier: upgrade to 4.2.4 or later
- Napi-Postinstall: upgrade to 0.3.2 or later
- Synckit: upgrade to 0.11.10 or later

## Technical details

This is a supply chain compromise involving the embedding of malicious code (CWE-506) within several popular NPM packages, most notably eslint-config-prettier. The vulnerability is triggered during the package installation process via a malicious 'install.js' script. On Windows environments, this script executes a malicious DLL named 'node-gyp.dll'. The attack does not require authentication and is being exploited in the wild. Users should immediately audit their dependency trees and revert to known-good versions or apply vendor-provided patches.

## Affected products

- Prettier eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7
- Prettier eslint-plugin-prettier 4.2.2, 4.2.3
- alexghr got-fetch 5.1.1, 5.1.2
- homarr homarr 1.29.0 to 1.30.0
- un-ts napi-postinstall 0.3.1
- un-ts pkgr/core 0.2.8
- un-ts synckit 0.11.9

## Identifiers

- CVE-2025-54313
- GHSA-f29h-pxvx-f335

## Timeline

- 2025-07-23: other: Initial CVE modification recorded
- 2026-01-22: disclosed: Vulnerability details published
- 2026-01-22: kev added: Added to CISA Known Exploited Vulnerabilities catalog

## Related threats

- [Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege…](https://junglewise.ai/threats/cve-2025-67493-homarr-is-an-open-source-dashboard-prior-to-version-1-45-3-it-was)
- [Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution…](https://junglewise.ai/threats/cve-2025-64759-homarr-is-an-open-source-dashboard-prior-to-version-1-43-3-stored)
- [MAL-2025-6022 - Malicious code in eslint-config-prettier (npm)](https://junglewise.ai/threats/malicious-code-in-eslint-config-prettier-npm-12eccf9a)
- [MAL-2025-6026 - Malicious code in synckit (npm)](https://junglewise.ai/threats/malicious-code-in-synckit-npm-9651a0a5)
- [MAL-2025-6025 - Malicious code in napi-postinstall (npm)](https://junglewise.ai/threats/malicious-code-in-napi-postinstall-npm-dce800bf)