Poisoned Pipeline

Poisoned Pipeline / Incidents / AS72

AS72 · 2025-07

eslint-config-prettier phishing (npnjs.com) and node-gyp.dll

npmWindows softwareDeveloper workstation

In July 2025 maintainer JounQin confirmed a phishing mail that added a
malicious npm token. Attackers published eslint-config-prettier 8.10.1,
9.1.1, 10.1.6 and 10.1.7 plus eslint-plugin-prettier 4.2.2/4.2.3,
synckit 0.11.9, @pkgr/core 0.2.8 and napi-postinstall 0.3.1. Affected
prettier versions ran install.js which launched node-gyp.dll on Windows
(CVE assigned). Same npnjs.com campaign later hit npm is (AS69) and
got-fetch (AS73). Dependabot/Renovate PRs upgraded some repos onto the
bad versions. StepSecurity investigation.

Mapped techniques

supply-chain phished maintainer token

T0113 · Initial Access · Compromised user account

Phishing added a new npm token on JounQin’s account.

T0121 · Resource Development · Compromised legitimate artifact

Multiple prettier-ecosystem packages republished.

T0151 · Execution · Installation scripts

install.js launched node-gyp.dll on Windows.

T0109 · Resource Development · Publish malicious artifact

Versions published outside the project’s CI, no provenance.

Sources