CVE-2025-54313 PoC — eslint-config-prettier 安全漏洞

Source

https://github.com/nihilor/cve-2025-54313

Associated Vulnerability

Title:eslint-config-prettier 安全漏洞 (CVE-2025-54313)
Description:eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Description

Checks projects for compromised packages, suspicious files, and import statements.

Readme

# cve-2025-54313
Checks projects for compromised packages, suspicious files, and import statements, see [is Supply Chain attack](https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack)

## How?

Just execute the script in the terminal/console. Consider to install `maple` first.

```sh
npm install -g maple
chmod +x cve-2025-54313.sh
./cve-2025-54313.sh
```

![](cve-2025-54313.png)

## License

GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007

Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed. See [LICENSE](./LICENSE)
for details.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!