Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Embedded Malicious Code

🗓️ 23 Jul 2025 06:15:37Reported by Veracode Vulnerability DatabaseType 
veracode
 veracode🔗 sca.analysiscenter.veracode.com👁 4 Views

eslint-config-prettier is vulnerable due to embedded malicious code from a compromised install.js script

Related
Detection
Refs
ReporterTitlePublishedViews
Family
GithubExploit		Exploit for CVE-2025-54313
26 Jul 202511:32
–githubexploit
IBM Security Bulletins		Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem
12 Nov 202507:25
–ibm
IBM Security Bulletins		Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in eslint-config-prettier
6 Oct 202519:10
–ibm
Circl		CVE-2025-54313
20 Jul 202500:35
–circl
CISA KEV Catalog		Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
22 Jan 202600:00
–cisa_kev
CISA		 CISA Adds Four Known Exploited Vulnerabilities to Catalog
22 Jan 202612:00
–cisa
CNNVD		eslint-config-prettier 安全漏洞
19 Jul 202500:00
–cnnvd
CVE		CVE-2025-54313
19 Jul 202500:00
–cve
Cvelist		CVE-2025-54313
19 Jul 202500:00
–cvelist
EUVD		EUVD-2025-21972
3 Oct 202520:07
–euvd
Rows per page
Vulners
Node
alexghrgot-fetchRange5.1.11–5.1.12js
OR
un-tssynckitMatch0.11.9js
OR
core@pkgr/coreMatch0.2.8js
OR
prettiereslint-config-prettierMatch8.10.1js
OR
prettiereslint-config-prettierMatch9.1.1js
OR
prettiereslint-config-prettierRange10.1.6–10.1.7js
OR
prettiereslint-plugin-prettierRange4.2.2–4.2.3js
OR
un-tsnapi-postinstallMatch0.3.1js
SourceLink
cisawww.cisa.gov/known-exploited-vulnerabilities-catalog
bleepingcomputerwww.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/
bleepingcomputerwww.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/
checkmarxwww.checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1
npmjswww.npmjs.com/package/eslint-config-prettier
stepsecuritywww.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise
githubwww.github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9
securewww.secure.software/npm/packages/got-fetch
githubwww.github.com/prettier/eslint-config-prettier/issues/339
nvdwww.nvd.nist.gov/vuln/detail/CVE-2025-54313
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
03 Jun 2026 09:20Current
6.2Medium risk
Vulners AI Score6.2
CVSS 3.17.5
EPSS0.14674
SSVC
embedded malicious codevulnerabilitycompromised scriptnode-gyp.dll malwarewindows installation
4