MetaDefender Software Supply Chain

On July 18, 2025, a trusted JavaScript library with over 31 million weekly downloads, eslint-config-prettier, was weaponized in a targeted supply chain attack that highlights just how vulnerable open-source ecosystems can be. The breach began with a phishing email that tricked the maintainer into leaking their token. Using the exposed credential, the attacker published unauthorized versions of the package, which contained a postinstall script that executed a trojan DLL on Windows machines during installation.