CVE-2025-54313 IOC Scanner

Cross-platform scanners for detecting Indicators of Compromise (IOCs) related to the eslint-config-prettier supply chain attack (CVE-2025-54313).

On July 18, 2025, several popular npm packages were compromised through a phishing attack.

The attacker gained access to the maintainer's npm tokens and published malicious versions containing platform-specific malware.

Affected Packages and Versions

Windows Version

1. Download the PowerShell script:

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/scavenger_scanner/CVE-2025-54313-Scanner.ps1" -OutFile "CVE-2025-54313-Scanner.ps1"

2. Unblock the script:

Unblock-File -Path ".\CVE-2025-54313-Scanner.ps1"

3. Set execution policy (if needed):

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Linux Version

1. Download the bash script:

curl -O https://raw.githubusercontent.com/scavenger_scanner/CVE-2025-54313-Scanner.sh

2. Make it executable:

chmod +x CVE-2025-54313-Scanner.sh

3. Install optional dependencies for better performance:

# Debian/Ubuntu
sudo apt-get install jq

# RHEL/CentOS/Fedora
sudo yum install jq

# macOS
brew install jq

Windows (PowerShell)

Quick Scan (current directory)

.\CVE-2025-54313-Scanner.ps1 -QuickScan

Full System Scan

.\CVE-2025-54313-Scanner.ps1

Scan Specific Directory

.\CVE-2025-54313-Scanner.ps1 -ScanPath "D:\Projects"

With Detailed Output

.\CVE-2025-54313-Scanner.ps1 -DetailedOutput

With Custom Report Path

.\CVE-2025-54313-Scanner.ps1 -ReportPath "C:\Security\CVE-Report.txt"

Linux/Unix (Bash)

Quick Scan (current directory)

./CVE-2025-54313-Scanner.sh -q

Full System Scan

sudo ./CVE-2025-54313-Scanner.sh

Scan Specific Directory

./CVE-2025-54313-Scanner.sh --path /home/user/projects

With Detailed Output

./CVE-2025-54313-Scanner.sh -q -d

With Custom Report Path

./CVE-2025-54313-Scanner.sh --report /tmp/cve-report.txt

Show Help

./CVE-2025-54313-Scanner.sh --help

Known IOCs

1. Malware Files

   • Windows: node-gyp.dll, loader.dll, version.dll, umpdc.dll, profapi.dll
   • Linux: node-gyp.so, loader.so, version.so, libumpdc.so, libprofapi.so
   • install.js files with suspicious code patterns
   • Known SHA256 hashes:
     • c68e42f416f482d43653f36cd14384270b54b68d6496a8e34ce887687de5b441 (node-gyp.dll/1st stage)
     • 5bed39728e404838ecd679df65048abcb443f8c7a9484702a2ded60104b8c4a9 (2nd stage Scavenger)

Platform-Specific Locations

Windows

• Temp Directory: %TEMP%
• NPM Config: %USERPROFILE%\.npmrc, %APPDATA%\npm\.npmrc
• Scan Path Default: C:\

Linux

• Temp Directories: /tmp, /var/tmp, $TMPDIR
• NPM Config: ~/.npmrc, ~/.config/npm/.npmrc, /usr/local/etc/npmrc, /etc/npmrc
• Scan Path Default: /

Found new IOCs or have suggestions for improvement?

1. Fork this repository
2. Create a feature branch
3. Commit your changes
4. Push to the branch
5. Open a Pull Request

Reporting New IOCs

Please include:

• File hashes (SHA256)
• File paths and names
• Suspicious code patterns
• Platform information (Windows/Linux)

📚 Further Reading

• Endor Labs Blog Post
• GitHub Issue #339
• NVD Entry
• Snyk Vulnerability Database

🔍 Quick Command Reference

Windows PowerShell

# Quick scan current directory
.\CVE-2025-54313-Scanner.ps1 -QuickScan

# Full system scan with detailed output
.\CVE-2025-54313-Scanner.ps1 -DetailedOutput

# Scan specific path
.\CVE-2025-54313-Scanner.ps1 -ScanPath "C:\Users\John\Projects"

Linux Bash

# Quick scan current directory
./CVE-2025-54313-Scanner.sh -q

# Full system scan with detailed output  
sudo ./CVE-2025-54313-Scanner.sh -d

# Scan specific path
./CVE-2025-54313-Scanner.sh -p /home/john/projects

# Show all options
./CVE-2025-54313-Scanner.sh --help