Compromised npm package (eslint-config-prettier) malicious DLL activity

Adair Collins@ajc

•updated Jul 19, 2025•5•4•117

Detects Windows systems invoking rundll32.exe to execute DLLs associated with compromised npm package versions of eslint-config-prettier (10.1.6–10.1.9). These versions were published without corresponding GitHub commits and may initiate callbacks to FirebaseDotSu, indicating potential command-and-control activity.