CVE-2025-54313

一、漏洞信息
 漏洞编号：[CVE-2025-54313](https://nvd.nist.gov/vuln/detail/CVE-2025-54313)
 漏洞归属组件：[polkit](https://gitee.com/src-openeuler/polkit)
 漏洞归属的版本：0.116,0.118,0.120,122,123,125
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
 漏洞简述：
  eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 contain embedded malicious code as part of a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows systems.
 漏洞公开时间：2025-07-20 01:15:23
 漏洞创建时间：2025-08-12 11:03:20
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-54313
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://news.ycombinator.com/item?id=44608811 |  |
|  | https://news.ycombinator.com/item?id=44609732 |  |
|  | https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise |  |
|  | https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/ |  |
|  | https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions |  |
|  | https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise |  |
|  | https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions |  |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://news.ycombinator.com/item?id=44609732 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-54313 |  |
|  | https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise |  |
|  | https://news.ycombinator.com/item?id=44608811 |  |
|  | https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise |  |
|  | https://www.mend.io/vulnerability-database/CVE-2025-54313 |  |
|  | https://github.com/community-scripts/ProxmoxVE/discussions/6115 |  |
|  | https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-54313 |  |
|  | https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://github.com/community-scripts/ProxmoxVE/discussions/6115 |  |
|  | https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only |  |
|  | https://github.com/advisories/GHSA-f29h-pxvx-f335 |  |
|  | https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only |  |
|  | https://github.com/community-scripts/ProxmoxVE/discussions/6115 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-54313 |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only |  |
|  | https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware |  |
|  | https://secure.software/npm/packages/got-fetch |  |
|  | https://github.com/prettier/eslint-config-prettier |  |
|  | https://github.com/community-scripts/ProxmoxVE/discussions/6115 |  |
|  | https://checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1 |  |
|  | https://access.redhat.com/security/cve/cve-2025-54313 |  |
|  | https://github.com/prettier/eslint-config-prettier |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://secure.software/npm/packages/got-fetch |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1 |  |
|  | https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://snyk.io/blog/maintainers-of-eslint-prettier-plugin-attacked-via-npm-supply-chain-malware/ |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://snyk.io/blog/maintainers-of-eslint-prettier-plugin-attacked-via-npm-supply-chain-malware/ |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://snyk.io/blog/maintainers-of-eslint-prettier-plugin-attacked-via-npm-supply-chain-malware/ |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://snyk.io/blog/maintainers-of-eslint-prettier-plugin-attacked-via-npm-supply-chain-malware/ |  |
|  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  |
|  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  |
|  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  |
|  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  |
|  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://snyk.io/blog/maintainers-of-eslint-prettier-plugin-attacked-via-npm-supply-chain-malware/ |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-54313 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-54313 |  |
|  | https://github.com/prettier/eslint-config-prettier/issues/339 |  |
|  | https://news.ycombinator.com/item?id=44608811 |  |
|  | https://news.ycombinator.com/item?id=44609732 |  |
|  | https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise |  |
|  | https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/ |  |
|  | https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions |  |
|  | https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2382071 |  |
|  | https://secure.software/npm/packages/got-fetch |  |
|  | https://checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  | github_advisory |
|  |  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  | github_advisory |
|  |  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  | github_advisory |
|  |  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  | github_advisory |
|  |  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  | github_advisory |
|  |  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  | osv |
|  |  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  | osv |
|  |  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  | osv |
|  |  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  | osv |
|  |  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  | osv |
|  |  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  | whitesource |
|  |  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  | whitesource |
|  |  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  | whitesource |
|  |  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  | whitesource |
|  |  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  | whitesource |
|  |  | https://github.com/prettier/eslint-config-prettier/commit/9b0b0a47ec28a7a83cf65e8436a8776910379385 |  | snyk |
|  |  | https://github.com/prettier/eslint-plugin-prettier/commit/ec39dd4400f10c52d10cd991c10fa8de51ceb854 |  | snyk |
|  |  | https://github.com/un-ts/napi-postinstall/commit/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9 |  | snyk |
|  |  | https://github.com/un-ts/pkgr/commit/e1420c99e44d8a2ae949381f9fbe1af5ba9cb1dd |  | snyk |
|  |  | https://github.com/un-ts/synckit/commit/8f2ee32d4f75736a1c8d7e1101190a71e48909e4 |  | snyk |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(125):不受影响
2.openEuler-20.03-LTS-SP4(0.116):不受影响
3.openEuler-22.03-LTS-SP3(0.120):不受影响
4.openEuler-22.03-LTS-SP4(0.120):不受影响
5.openEuler-24.03-LTS(123):不受影响
6.openEuler-24.03-LTS-Next(123):不受影响
7.openEuler-24.03-LTS-SP1(123):不受影响
8.openEuler-24.03-LTS-SP2(123):不受影响

修复是否涉及abi变化(是/否)：
  1.master(125):否
2.openEuler-20.03-LTS-SP4(0.116):否
3.openEuler-22.03-LTS-SP3(0.120):否
4.openEuler-22.03-LTS-SP4(0.120):否
5.openEuler-24.03-LTS(123):否
6.openEuler-24.03-LTS-Next(123):否
7.openEuler-24.03-LTS-SP1(123):否
8.openEuler-24.03-LTS-SP2(123):否

原因说明：
  1.master(125):不受影响-漏洞代码不存在
2.openEuler-20.03-LTS-SP4(0.116):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3(0.120):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4(0.120):不受影响-漏洞代码不存在
5.openEuler-24.03-LTS(123):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS-Next(123):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(123):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP2(123):不受影响-漏洞代码不存在

src-openEuler/polkit

内容风险标识

评论 (6)

src-openEuler/polkit .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-54313

评论 (6)

搜索帮助

src-openEuler/polkit