Exploitation Summary
CVE-2025-54313 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 22, 2026. EIP tracks 3 public exploits from researchers including Paspke, ShinP451, nihilor.
AI-analyzed exploit summary This repository contains a PowerShell and shell script scanner designed to detect indicators of compromise (IOCs) related to the CVE-2025-54313 supply chain attack involving malicious npm packages like eslint-config-prettier. It checks for compromised package versions, suspicious files, and known malicious hashes.
Description
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Exploits (3)
This repository contains a PowerShell and shell script scanner designed to detect indicators of compromise (IOCs) related to the CVE-2025-54313 supply chain attack involving malicious npm packages like eslint-config-prettier. It checks for compromised package versions, suspicious files, and known malicious hashes.
This repository contains a PowerShell and Bash-based scanner for detecting indicators of compromise (IOCs) related to CVE-2025-54313, a supply chain attack involving compromised npm packages like eslint-config-prettier. The scanner checks for malicious files, suspicious scripts, and known malicious hashes but does not include exploit code.
This repository contains a Bash script that scans for vulnerable npm packages and suspicious files in a project, specifically targeting supply chain attacks. It checks for known vulnerable package versions, suspicious files like 'node-gyp.dll', and usage of compromised packages in code.
References (10)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N