eslint-plugin-anthropic-security 0.2.0 → 0.3.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "eslint-plugin-anthropic-security",
-  "version": "0.2.0",
-  "description": "ESLint plugin for Anthropic SDK security — catches hardcoded API keys in the Claude client options.",
+  "version": "0.3.1",
+  "description": "ESLint plugin for Anthropic SDK security — catches hardcoded Claude API keys, the browser escape hatch that ships them to every visitor, and system prompts assembled from untrusted input.",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
@@ -62,7 +62,7 @@
     "node": ">=18.0.0"
   },
   "peerDependencies": {
-    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",
+    "eslint": "^8.40.0 || ^9.0.0 || ^10.0.0",
     "@anthropic-ai/sdk": ">=0.1.0 <1.0.0",
     "@anthropic-ai/claude-agent-sdk": ">=0.1.0 <1.0.0"
   },
@@ -75,7 +75,7 @@
     }
   },
   "dependencies": {
-    "@interlace/eslint-devkit": "^1.9.0"
+    "@interlace/eslint-devkit": "^1.11.0"
   },
   "funding": {
     "type": "github",

package/src/index.js

@@ -1,37 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.configs = exports.plugin = exports.rules = exports.noHardcodedApiKey = exports.noBrowserApiKeyExposure = void 0;
-var no_browser_api_key_exposure_2 = require("./rules/no-browser-api-key-exposure");
-Object.defineProperty(exports, "noBrowserApiKeyExposure", { enumerable: true, get: function () { return no_browser_api_key_exposure_2.noBrowserApiKeyExposure; } });
-var no_hardcoded_api_key_2 = require("./rules/no-hardcoded-api-key");
-Object.defineProperty(exports, "noHardcodedApiKey", { enumerable: true, get: function () { return no_hardcoded_api_key_2.noHardcodedApiKey; } });
-exports.rules = {
-    get 'no-browser-api-key-exposure'() { return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure; },
-    get 'no-hardcoded-api-key'() { return require("./rules/no-hardcoded-api-key").noHardcodedApiKey; },
-
-};
-exports.plugin = {
-    meta: {
-        name: 'eslint-plugin-anthropic-security',
-        version: '0.2.0',
-    },
-    rules: exports.rules,
-};
-const enabled = {
-    plugins: {
-        'anthropic-security': exports.plugin,
-    },
-    rules: {
-        'anthropic-security/no-browser-api-key-exposure': 'error',
-        'anthropic-security/no-hardcoded-api-key': 'error',
-    },
-};
-exports.configs = {
-    minimal: enabled,
-    recommended: enabled,
-    strict: enabled,
-};
-exports.default = {
-    ...exports.plugin,
-    configs: exports.configs,
-};
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=exports.noUntrustedContentInPrompt=exports.noHardcodedApiKey=exports.noBrowserApiKeyExposure=void 0;var no_browser_api_key_exposure_2=require("./rules/no-browser-api-key-exposure");Object.defineProperty(exports,"noBrowserApiKeyExposure",{enumerable:true,get:function(){return no_browser_api_key_exposure_2.noBrowserApiKeyExposure}});var no_hardcoded_api_key_2=require("./rules/no-hardcoded-api-key");Object.defineProperty(exports,"noHardcodedApiKey",{enumerable:true,get:function(){return no_hardcoded_api_key_2.noHardcodedApiKey}});var no_untrusted_content_in_prompt_2=require("./rules/no-untrusted-content-in-prompt");Object.defineProperty(exports,"noUntrustedContentInPrompt",{enumerable:true,get:function(){return no_untrusted_content_in_prompt_2.noUntrustedContentInPrompt}});exports.rules={get"no-browser-api-key-exposure"(){return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure},get"no-hardcoded-api-key"(){return require("./rules/no-hardcoded-api-key").noHardcodedApiKey},get"no-untrusted-content-in-prompt"(){return require("./rules/no-untrusted-content-in-prompt").noUntrustedContentInPrompt}};exports.plugin={meta:{name:"eslint-plugin-anthropic-security",version:"0.3.1"},rules:exports.rules};const enabled={plugins:{"anthropic-security":exports.plugin},rules:{"anthropic-security/no-browser-api-key-exposure":"error","anthropic-security/no-hardcoded-api-key":"error"}};const strict={plugins:{"anthropic-security":exports.plugin},rules:{...enabled.rules,"anthropic-security/no-untrusted-content-in-prompt":"error"}};exports.configs={minimal:enabled,recommended:enabled,strict};exports.default={...exports.plugin,configs:exports.configs};

package/src/oxlint.js

@@ -1,3 +1 @@
-"use strict";
-const index_1 = require("./index");
-module.exports = index_1.plugin;
+"use strict";const index_1=require("./index");module.exports=index_1.plugin;

package/src/rules/no-browser-api-key-exposure/index.js

@@ -1,11 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noBrowserApiKeyExposure = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noBrowserApiKeyExposure = (0, eslint_devkit_1.createBrowserEscapeHatchRule)({
-    ruleName: 'no-browser-api-key-exposure',
-    vendor: 'Anthropic',
-    modules: ['@anthropic-ai'],
-    docsUrl: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-browser-api-key-exposure.md',
-    documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noBrowserApiKeyExposure=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noBrowserApiKeyExposure=(0,eslint_devkit_1.createBrowserEscapeHatchRule)({ruleName:"no-browser-api-key-exposure",vendor:"Anthropic",modules:["@anthropic-ai"],docsUrl:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-browser-api-key-exposure.md",documentationLink:"https://docs.anthropic.com/en/api/getting-started"});

package/src/rules/no-hardcoded-api-key/index.js

@@ -1,13 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noHardcodedApiKey = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noHardcodedApiKey = (0, eslint_devkit_1.createSdkApiKeyRule)({
-    ruleName: 'no-hardcoded-api-key',
-    vendor: 'Anthropic',
-    modules: ['@anthropic-ai'],
-    keyProps: ['apiKey', 'authToken'],
-    fixTemplate: 'new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })',
-    docsUrl: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md',
-    documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noHardcodedApiKey=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noHardcodedApiKey=(0,eslint_devkit_1.createSdkApiKeyRule)({ruleName:"no-hardcoded-api-key",vendor:"Anthropic",modules:["@anthropic-ai"],keyProps:["apiKey","authToken"],fixTemplate:"new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })",docsUrl:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md",documentationLink:"https://docs.anthropic.com/en/api/getting-started"});

package/src/rules/no-untrusted-content-in-prompt/index.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noUntrustedContentInPrompt=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noUntrustedContentInPrompt=(0,eslint_devkit_1.createSystemPromptInjectionRule)({ruleName:"no-untrusted-content-in-prompt",vendor:"Anthropic",modules:["@anthropic-ai"],requestPaths:["messages.create","messages.stream"],systemPromptProps:["system"],docsUrl:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-untrusted-content-in-prompt.md",documentationLink:"https://docs.anthropic.com/en/docs/system-prompts"});