{"action":"Upgrade @pkgr/core to 0.2.9 or later.","affected":[{"fixed":"0.2.9","introduced":"0.2.8"}],"component":"@pkgr/core","cve_ids":["CVE-2025-54313"],"ecosystem":"npm","epss":0.05125,"exploited":true,"fixed_versions":["0.2.9"],"ghsa_id":"GHSA-f29h-pxvx-f335","id":"tcs_01M5KFM4EP326X21FDPQ9BMMVP","modified_at":"2026-02-03T03:09:09.088269Z","published_at":"2025-07-19T18:30:33Z","references":["https://osv.dev/vulnerability/GHSA-f29h-pxvx-f335","https://nvd.nist.gov/vuln/detail/CVE-2025-54313","https://github.com/prettier/eslint-config-prettier/issues/339","https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385","https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854","https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9","https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd","https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4","https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise","https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions","https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313","https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware","https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise","https://secure.software/npm/packages/got-fetch","https://news.ycombinator.com/item?id=44609732","https://news.ycombinator.com/item?id=44608811","https://github.com/prettier/eslint-config-prettier","https://github.com/community-scripts/ProxmoxVE/discussions/6115","https://checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-f29h-pxvx-f335#npm/@pkgr/core","url":"https://osv.dev/vulnerability/GHSA-f29h-pxvx-f335"},{"source":"kev","source_id":"CVE-2025-54313","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code"}