Embedded Malicious Code in eslint-config-prettier

Installing an affected package version can result in automatic execution of attacker-supplied code on Windows developer or CI/CD systems during dependency installation. This can lead to host compromise, theft of npm authentication tokens and other credentials, malware staging or delivery of secondary payloads, reconnaissance, persistence, and potential downstream software supply-chain exposure if compromised build environments publish or sign additional artifacts. Because eslint-config-prettier is widely used, the blast radius can include developer workstations, build runners, and any projects that resolved the malicious versions through direct or transitive dependencies.

Prevent installation of the known-bad versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 through dependency pinning, registry blocking, and software composition analysis policies. Prefer lockfile enforcement and trusted internal package proxies to reduce exposure to malicious upstream releases. Restrict or monitor npm lifecycle script execution where operationally feasible, especially in CI environments. Harden maintainer and registry accounts with phishing-resistant MFA and token hygiene. On Windows development and build systems, monitor for suspicious npm install activity, unexpected install.js execution, rundll32 spawning from Node/npm processes, and loading of node-gyp.dll or similarly named DLL payloads.

Remove affected versions of eslint-config-prettier from all environments and dependency trees, and upgrade to a non-malicious release such as 8.10.2 or later. Rebuild dependencies from trusted sources after clearing package caches and lockfiles as appropriate. Review whether permissive version ranges or automated dependency tooling introduced the malicious versions. If any affected version was installed, especially on Windows, treat the system as potentially compromised: isolate affected hosts, perform forensic review, remove malicious artifacts, and reimage if necessary. Rotate npm tokens, registry credentials, CI/CD secrets, and any other credentials accessible from the affected host. Review package provenance and verify that only trusted releases are present in internal mirrors and artifact repositories.