High · published July 19, 2025
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 92.4th percentile for exploit probability.
🚨 If you’ve installed certain versions of eslint-config-prettier, you may have unwittingly invited malware into your project! Think of it like accidentally getting a food delivery that contained a surprise ingredient you didn’t order — but instead of something harmless, it’s a toxic substance that wreaks havoc in your kitchen. That malicious code is lurking, waiting to pounce when you least expect it! Once this crafty installation script runs, it launches the node-gyp.dll malware on Windows, which could allow an attacker to wreak absolute havoc on your system! This means data breaches, system corruption, and a complete disruption of your workflow, all from a seemingly innocent package. You don’t want to be the one who brought this sneaky interloper into your environment!
Think of it like accidentally getting a food delivery that contained a surprise ingredient you didn’t order — but instead of something harmless, it’s a toxic substance that wreaks havoc in your kitchen. That malicious code is lurking, waiting to pounce when you least expect it! This vulnerability in eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 features an install.js script that executes malicious code, compromising the supply chain during package installation.
Once this crafty installation script runs, it launches the node-gyp.dll malware on Windows, which could allow an attacker to wreak absolute havoc on your system! This means data breaches, system corruption, and a complete disruption of your workflow, all from a seemingly innocent package. You don’t want to be the one who brought this sneaky interloper into your environment! To shield your projects from this threat, immediately uninstall any affected versions of eslint-config-prettier and update to the latest version. Always verify package integrity and consider using tools to scan for vulnerabilities in dependencies. Keeping your environment clean and secure is essential! You've got this! By taking these steps, you can lock down your project and keep the bad guys at bay. 🛡️