Description
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Recommendation
Update the got-fetch package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.1.11, <= 5.1.12
- Patched version(s): 6.0.0
References
Could your website be exposed too?
SmartScanner can check your website for eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Elysia affected by arbitrary code injection through cookie config - CVE-2025-66457
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder - CVE-2025-24361
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/vite-builder - CVE-2025-24360
You might also like:
See something that needs correcting? Let us knowUpdated January 22, 2026