A critical supply chain vulnerability in the Prettier eslint-config-prettier package is being actively exploited in the wild to execute malicious code on Windows developer and CI environments.

This is a supply chain compromise where the package contains embedded malicious code (CWE-506). The vulnerability is triggered automatically upon package installation, where an install.js script executes the node-gyp.dll malware, requiring no user authentication to achieve execution.

The vulnerability carries a CVSS score of 9.5, reflecting its severe impact as a supply chain attack. Successful exploitation grants an attacker the ability to execute unauthorized code on developer workstations or CI/CD pipelines, potentially leading to persistent system compromise, lateral movement within the development environment, and the injection of further malicious code into downstream software builds.

Immediate Action: Organizations must immediately update to eslint-config-prettier versions 8.10.2, 9.1.2, or 10.1.8. Furthermore, ensure associated dependencies like eslint-plugin-prettier (fixed in 4.2.4) and synckit (fixed in 0.11.10) are updated to their respective patched versions.

Proactive Monitoring: Audit developer workstations and CI/CD build environments for the presence of the node-gyp.dll file or suspicious child processes originating from npm install routines. Monitor network egress logs for unauthorized traffic originating from build servers.

Compensating Controls: Implement strict package-lock.json auditing and utilize software composition analysis tools to detect and block the installation of known compromised package versions.

Public Exploit Available: Yes: Multiple public proof-of-concept repositories exist on GitHub, including those by ShinP451 and nihilor.

Given the active exploitation and the critical nature of supply chain compromises, immediate action is required to identify and update all affected instances of eslint-config-prettier. Organizations should prioritize clearing their dependency caches and verifying the integrity of their development environments to ensure that no malicious artifacts persist post-remediation.