CVE-2025-54313: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

The vulnerability is a result of a supply chain attack where several popular npm packages were compromised and republished with malicious code. The attackers gained access to the npm accounts of the package maintainers and published new versions containing a malicious install.js script. This script was configured to run automatically after the package is installed via the postinstall hook in package.json.

The install.js script contains two primary functions: install and download. The install function acts as the entry point. It first checks if the host operating system is Windows. If it is, it proceeds to call the download function. The download function then fetches a malicious DLL file (node-gyp.dll) from a remote server and saves it to the local filesystem. Finally, the install function executes the downloaded DLL, completing the infection.

The provided git commits only show the patches, which consist of version bumps to non-malicious versions. The malicious code itself was never committed to the git repositories, a common tactic in supply chain attacks to evade detection. The identification of the vulnerable functions is based on the analysis of the malicious install.js script, as documented in the security blogs linked in the vulnerability details.