Packages / synckit / Security

HighVulnerabilityGHSA-f29h-pxvx-f335CVE-2025-54313Published 19 Jul 2025

eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

Affected releases · synckit

  • 0.11.x0.11.9Fixed in 0.11.10

On 0.11.x, the newest line:

npm install synckit@0.11.10

  1. Not affected

    0.1.0 – 0.11.8

    50 releases

  2. Affected

    0.11.9

    1 release

  3. Fixed

    0.11.10 – 0.12.3

    8 releases, latest

59 stable releases of synckit, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for synckit. It is read in your browser and sent nowhere.

What happens

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.