npm napi-postinstall vulnerabilities

Latest npm napi-postinstall CVEs

Newest publication first

1. CVE-2025-54313 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

   Published 2025-07-19

   High·CVSS 7.5 EPSS 5.1% CISA KEV added 2026-01-22 Exploited in the wild

   eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.