Supply-chain attacksBriefPublic record
eslint-config-prettier / is / synckit npm phishing hijack (CVE-2025-54313)
Maintainer phished through the `npnjs.com` lookalike domain.
- Disclosed
What happened
- Affected: eslint-config-prettier 8.10.1, 9.1.1, 10.1.6 and 10.1.7, which shipped the “Scavenger” Windows DLL loader.
Live scores
Live scores
CVE-2025-54313- EPSS
- 0.051
some chance of attack soon - VEDAS
- 0.980
strong exploit evidence - On CISA KEV
- Yes, since 2026-01-22
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://nvd.nist.gov/vuln/detail/CVE-2025-54313
- https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.