node-gyp.dll
node-gyp.dll (also referenced as “node_gypdll”) is Windows malware dropped/executed as part of a malicious-code supply-chain compromise affecting the npm package eslint-config-prettier (Prettier). In the described activity (tracked as CVE-2025-54313), installing affected eslint-config-prettier versions (8.10.1, 9.1.1, 10.1.6, 10.1.7) triggers execution of embedded malicious code during package installation, which runs an install.js script that deploys and/or launches node-gyp.dll on Windows systems. The compromise is characterized as targeting development environments/CI-CD via npm install behavior and is noted as potentially enabling arbitrary code execution on impacted Windows hosts. No specific threat actor attribution, additional capabilities beyond execution via install.js, or concrete IOCs (e.g., hashes, C2 infrastructure) are provided in the source content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"The vulnerability triggers an install.js file deployment of node-gyp.dll malware on Windows systems, creating a supply-chain attack vector targeting development environments."
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
"Prettier’s eslint-config-prettier package contains embedded malicious code (CVE-2025-54313) that executes during installation. The vulnerability triggers an install.js file deployment of node-gyp.dll malware on Windows systems, creating a supply-chain attack vector targeting development environments."
Execution
1 technique
Execution
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious DLL payload dropped during a compromised npm package installation (eslint-config-prettier), used to compromise Windows developer/CI environments as part of a supply-chain attack.
Malicious payload referenced as being launched via an install.js script as part of a supply-chain compromise of eslint-config-prettier packages on Windows.
Malicious payload (named node-gyp.dll) deployed during installation of a compromised development dependency (eslint-config-prettier) on Windows, consistent with a supply-chain compromise targeting developer/CI environments.
Malicious Windows payload referenced as being launched during installation of compromised eslint-config-prettier packages, enabling arbitrary code execution.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.