Node.js Multiple Packages Embedded Malicious Code (CVE-2025-54313)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(245592);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/22");

  script_cve_id("CVE-2025-54313");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/02/12");

  script_name(english:"Node.js Multiple Packages Embedded Malicious Code (CVE-2025-54313)");

  script_set_attribute(attribute:"synopsis", value:
"Multiple packages in the Node.js JavaScript run-time environment are affected by embedded malicious code.");
  script_set_attribute(attribute:"description", value:
"Multiple nodejs packages were embedded with malicious code. Installing an affected package executes an install.js file
that launches the node-gyp.dll malware on Windows. The following nodejs packages and versions are affected:

  - @pkgr/core 0.2.8
  - eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7
  - eslint-plugin-prettier 4.2.2, 4.2.3
  - got-fetch 5.1.11, 5.1.12
  - napi-postinstall 0.3.1
  - synckit 0.11.9

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-f29h-pxvx-f335");
  # https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5bf8cbed");
  script_set_attribute(attribute:"solution", value:
"Upgrade to a fixed version of the affected package.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-54313");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

var package_constraints = [
  {'package':'@pkgr/core', 'constraints':[{'equal':'0.2.8', 'fixed_display':'0.2.9'}]},
  {'package':'eslint-config-prettier', 'constraints':[
    {'equal':'8.10.1', 'fixed_display':'8.10.2'},
    {'equal':'9.1.1', 'fixed_display':'9.1.2'},
    {'min_version':'10.1.6', 'max_version':'10.1.7', 'fixed_display':'10.1.8'}
  ]},
  {'package':'eslint-plugin-prettier', 'constraints':[{'min_version':'4.2.2', 'max_version':'4.2.3', 'fixed_display':'4.2.4'}]},
  {'package':'got-fetch', 'constraints':[{'min_version':'5.1.11', 'max_version':'5.1.12', 'fixed_display':'6.0.0'}]},
  {'package':'napi-postinstall', 'constraints':[{'equal':'0.3.1', 'fixed_display':'0.3.2'}]},
  {'package':'synckit', 'constraints':[{'equal':'0.11.9', 'fixed_display':'0.11.10'}]}
];

var pkg_name, module_installs, module_name, constraints;
var modules_names = [];

foreach pkg_name (package_constraints)
{
  append_element(value:pkg_name.package, var:modules_names);
};

module_installs = vcf_extras::nodejs_modules::get_app_info(modules_list:modules_names);

if (empty_or_null(module_installs))
  audit(AUDIT_HOST_NONE, 'vulnerable nodejs modules installed');

vcf::check_all_backporting(app_info:module_installs);

module_name = module_installs.app;

foreach pkg_name(package_constraints)
{
  if (pkg_name.package == module_name)
  {
    constraints = pkg_name.constraints;
    break;
  }
}

vcf::check_version_and_report(app_info:module_installs, constraints:constraints, severity:SECURITY_WARNING);