False-Positive: MAL-2025-6022

[ilyaholoday123]

PURL of wrongly matched component

pkg:npm/eslint-config-prettier@9.1.0

Hello!
Depscan detects vulnerability MAL-2025-6022 in dependency eslint-config-prettier 9.1.0 (purl: pkg:npm/eslint-config-prettier@9.1.0), although the vulnerability exists only in the following versions: 8.10.1, 9.1.1, 10.1.6, and 10.1.7.

Judging by bom.vdr, the feed for this vulnerability is incorrect, as it currently points to the range from version 8.10.1 up to and including 10.1.7:

{"name": "affectedVersionRange","value": "eslint-config-prettier@>=8.10.1-<=10.1.7"}

urls:
https://osv.dev/vulnerability/MAL-2025-6022
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eslint-config-prettier/MAL-2025-6022.json

Depscan findings

[prabhu]

@ilyaholoday123 could you kindly start using depscan v6 beta which uses vdb6 and is more accurate? You can do pip install with --pre argument.

pip install --pre owasp-depscan[all]

❯ uv run vdb --search pkg:npm/eslint-config-prettier@9.1.0

             ___
  /\  ._  ._  | |_  ._ _   _. _|_
 /--\ |_) |_) | | | | (/_ (_|  |_
      |   |

No results found!

❯ uv run vdb --search pkg:npm/eslint-config-prettier@9.1.1

             ___
  /\  ._  ._  | |_  ._ _   _. _|_
 /--\ |_) |_) | | | | (/_ (_|  |_
      |   |

                                                                                                                       VDB Results
┏━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CVE            ┃ Locator                              ┃ Fix Version ┃ Description                                                                                                                ┃ Affected Symbols                                   ┃
┡━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ CVE-2025-54313 │ pkg:npm/eslint-config-prettier@9.1.1 │ 9.1.2       │ ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ │                                                    │
│                │                                      │             │ ┃   eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code   ┃ │                                                    │
│                │                                      │             │ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ │                                                    │
│                │                                      │             │                                                                                                                            │                                                    │
│                │                                      │             │ eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.        │                                                    │
│                │                                      │             │ Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.              │                                                    │
├────────────────┼──────────────────────────────────────┼─────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ MAL-2025-6022  │ pkg:npm/eslint-config-prettier@9.1.1 │             │ ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ │                                                    │
│                │                                      │             │ ┃                                     Malicious code in eslint-config-prettier (npm)                                     ┃ │                                                    │
│                │                                      │             │ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ │                                                    │
│                │                                      │             │                                                                                                                            │                                                    │
│                │                                      │             │ This package installs a windows based malware file node-gyp.dll via install.js                                             │                                                    │
├────────────────┼──────────────────────────────────────┼─────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ CVE-2025-54313 │ pkg:npm/eslint-config-prettier@9.1.1 │             │ ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ │                                                    │
│                │                                      │             │ ┃   eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code   ┃ │                                                    │
│                │                                      │             │ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ │                                                    │
│                │                                      │             │                                                                                                                            │                                                    │
│                │                                      │             │ eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.        │                                                    │
│                │                                      │             │ Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.              │                                                    │
└────────────────┴──────────────────────────────────────┴─────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴────────────────────────────────────────────────────┘