Prettier eslint-config-prettier Embedded Malicious Code Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 22/01/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| got-fetch | = 5.1.1= 5.1.2 | |
| homarr | ≥ 1.29.0, < 1.30.0 | 1.30.0 |
| eslint-config-prettier | = 10.1.6= 10.1.7= 8.10.1= 9.1.1 | |
| eslint-plugin-prettier | = 4.2.2= 4.2.3 | |
| napi-postinstall | = 0.3.1 | |
| pkgr/core | = 0.2.8 | |
| synckit | = 0.11.9 | |
| @pkgr/core | ≥ 0.2.8, < 0.2.9 | 0.2.9 |
| eslint-config-prettier | ≥ 10.1.6, < 10.1.8≥ 8.10.1, < 8.10.2≥ 9.1.1, < 9.1.2 | 10.1.88.10.29.1.2 |
| eslint-plugin-prettier | ≥ 4.2.2, < 4.2.4 | 4.2.4 |
| got-fetch | ≥ 5.1.11, < 6.0.0 | 6.0.0 |
| napi-postinstall | ≥ 0.3.1, < 0.3.2 | 0.3.2 |
| synckit | ≥ 0.11.9, < 0.11.10 | 0.11.10 |
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free