chore: pin eslint-config-prettier and eslint-plugin-prettier versions to prevent malicious package installation #2239
+4
−4
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pin
eslint-config-prettier
andeslint-plugin-prettier
to exact versions to protect against the recent npm phishing attack that compromised these packages. The caret range^10.0.1
could have installed malicious versions 10.1.6 and 10.1.7.🔍 RCA
A phishing campaign compromised npm maintainer credentials, leading to malicious versions of
eslint-config-prettier
(10.1.6, 10.1.7) andeslint-plugin-prettier
(4.2.2, 4.2.3) being published. Our semver range^10.0.1
was vulnerable to installing the malicious 10.1.6 and 10.1.7 versions.📋 Changes
Pin exact versions of potentially vulnerable packages to prevent automatic installation of compromised versions through semver ranges.
package.json
: pinnedeslint-config-prettier
from^10.0.1
to10.1.5
andeslint-plugin-prettier
from^5.2.3
to5.5.1
package-lock.json
: removed version ranges.📎 References
https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise
🎯 Testing
Automated:
No new tests required - this is a dependency version change with no functional impact.
Manual:
pnpm install
to verify no version conflictspnpm run lint
to confirm ESLint configuration still workspnpm-lock.yaml
entries