Actively exploited vulnerabilities affecting Prettier products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-54313https://wildfortech.com/security#CVE-2025-54313A malicious version of the popular eslint-config-prettier npm package was published containing embedded malware. When developers or automated pipelines install the compromised package, an install.js script executes automatically and drops a file called node-gyp.dll on Windows systems. This supply-chain attack is particularly dangerous because it triggers silently during routine dependency installation, potentially compromising developer workstations, CI/CD environments, and any systems where the package is installed.Thu, 22 Jan 2026 00:00:00 GMTPrettiereslint-config-prettier