FOUR-25651: Embedded Malicious Code in eslint-config-prettier

[henryjonathanquispe]

Issue & Reproduction Steps

Per CVE-2025-54313, a malicious actor compromised the credentials of one of the maintainers via a phishing attack. This allowed the attacker to publish tampered versions of the package to npm.

Per a scan of our GitHub repositories, the following packages will need to be upgraded to version 8.10.2, 9.1.2, 10.1.8 or higher.

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-25651

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[cypress]

screen-builder    Run #1963

Run Properties:   Passed #1963  •  120f039ecf: FOUR-25651: Embedded Malicious Code in eslint-config-prettier

Project	screen-builder
Branch Review	bugfix/FOUR-25651
Run status	Passed #1963
Run duration	38m 34s
Commit	120f039ecf: FOUR-25651: Embedded Malicious Code in eslint-config-prettier
Committer	henryjonathanquispe
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	19
Skipped	0
Passing	374
View all changes introduced in this branch ↗︎

[processmaker-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube