eslint-plugin-anthropic-security 0.3.2 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +55 -53
- package/package.json +11 -2
- package/src/index.js +1 -1
package/README.md
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
<p align="center">
|
|
2
|
-
<a href="https://eslint.interlace.tools
|
|
2
|
+
<a href="https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security" target="blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/interlace-dark.svg"><img src="https://eslint.interlace.tools/logos/interlace-light.svg" alt="Interlace" height="90" /></picture></a>
|
|
3
3
|
|
|
4
4
|
<a href="https://docs.anthropic.com" target="_blank"><img src="https://eslint.interlace.tools/logos/claude.svg" alt="Anthropic Claude SDK" height="90" /></a>
|
|
5
5
|
|
|
6
|
-
<a href="https://oxc.rs" target="_blank"><img src="https://eslint.interlace.tools/logos/oxlint.svg" alt="oxlint" height="90" /></a>
|
|
6
|
+
<a href="https://oxc.rs" target="_blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/oxlint-dark.svg"><img src="https://eslint.interlace.tools/logos/oxlint-light.svg" alt="oxlint" height="90" /></picture></a>
|
|
7
7
|
|
|
8
|
-
<a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/logos/eslint.svg" alt="ESLint" height="90" /></a>
|
|
8
|
+
<a href="https://eslint.org" target="_blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/eslint-dark.svg"><img src="https://eslint.interlace.tools/logos/eslint-light.svg" alt="ESLint" height="90" /></picture></a>
|
|
9
9
|
</p>
|
|
10
10
|
|
|
11
11
|
<p align="center">
|
|
@@ -15,6 +15,7 @@
|
|
|
15
15
|
<p align="center">
|
|
16
16
|
<a href="https://www.npmjs.com/package/eslint-plugin-anthropic-security" target="_blank"><img src="https://img.shields.io/npm/v/eslint-plugin-anthropic-security.svg" alt="NPM Version" /></a>
|
|
17
17
|
<a href="https://www.npmjs.com/package/eslint-plugin-anthropic-security" target="_blank"><img src="https://img.shields.io/npm/dm/eslint-plugin-anthropic-security.svg" alt="NPM Downloads" /></a>
|
|
18
|
+
<a href="https://packagephobia.com/result?p=eslint-plugin-anthropic-security" target="_blank"><img src="https://badgen.net/packagephobia/install/eslint-plugin-anthropic-security" alt="Install Size" /></a>
|
|
18
19
|
<a href="https://opensource.org/licenses/MIT" target="_blank"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="Package License" /></a>
|
|
19
20
|
<a href="https://scorecard.dev/viewer/?uri=github.com/ofri-peretz/eslint" target="_blank"><img src="https://api.securityscorecards.dev/projects/github.com/ofri-peretz/eslint/badge" alt="OpenSSF Scorecard" /></a>
|
|
20
21
|
</p>
|
|
@@ -27,57 +28,25 @@ Security rules for [`@anthropic-ai/sdk`](https://www.npmjs.com/package/@anthropi
|
|
|
27
28
|
|
|
28
29
|
Every rule gates on the SDK actually being imported, so the plugin stays silent in files that don't use it.
|
|
29
30
|
|
|
30
|
-
## Philosophy
|
|
31
|
-
|
|
32
|
-
**Interlace** fosters **strength through integration**. Instead of stacking isolated rules, we **interlace** security directly into your workflow to create a resilient fabric of code. We believe tools should **guide rather than gatekeep**, providing educational feedback that strengthens the developer with every interaction.
|
|
33
|
-
|
|
34
31
|
<!-- AUTO-GENERATED:DOCTRINE:START - Do not edit manually -->
|
|
35
32
|
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
**
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
That is a trade, and it is made deliberately. It costs recall, and we measure what it
|
|
44
|
-
costs rather than assuming it is free.
|
|
45
|
-
|
|
46
|
-
## How the rules decide
|
|
47
|
-
|
|
48
|
-
**Evidence, not names.** A rule fires on what the code *does*, resolved through the
|
|
49
|
-
AST and ESLint's own scope analysis — not on an identifier that happens to contain
|
|
50
|
-
`query`, a method called `setItem`, or a file whose path contains `key`. Every one of
|
|
51
|
-
those was a real false positive in this ecosystem, found by reading our own output on
|
|
52
|
-
open-source projects and fixed with a test that fails on the unfixed rule.
|
|
53
|
-
|
|
54
|
-
Where a rule has known false-positive shapes, its page carries a **Not a finding**
|
|
55
|
-
section: what it deliberately stays quiet on, and what to check first when it fires
|
|
56
|
-
and you disagree.
|
|
57
|
-
|
|
58
|
-
## What you get
|
|
59
|
-
|
|
60
|
-
The rules below. Security rules carry a CWE mapping and, where one is assigned, a
|
|
61
|
-
CVSS score; every rule carries a fix on its message — in prose for a human and as
|
|
62
|
-
structured JSON for an agent. Install it, enable
|
|
63
|
-
`recommended`, and read the findings. If one of them is wrong,
|
|
64
|
-
[open an issue](https://github.com/ofri-peretz/eslint/issues) — a false positive is a
|
|
65
|
-
bug here, not a tuning exercise for you.
|
|
33
|
+
- **Why** — a linter nobody reads protects nothing. We would rather miss a finding
|
|
34
|
+
than spend your attention on one that was never real.
|
|
35
|
+
- **How** — evidence, not names. A rule fires on what the code *does*, resolved
|
|
36
|
+
through the AST and ESLint's own scope analysis.
|
|
37
|
+
- **What** — every finding carries its fix, in prose for a human and as structured
|
|
38
|
+
JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.
|
|
66
39
|
|
|
67
|
-
|
|
68
|
-
[
|
|
69
|
-
|
|
40
|
+
That trade costs recall, and we measure it:
|
|
41
|
+
[methodology](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-METHODOLOGY.md)
|
|
42
|
+
· [results](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-RESULTS.md)
|
|
43
|
+
· [a false positive is a bug](https://github.com/ofri-peretz/eslint/issues).
|
|
70
44
|
|
|
71
45
|
<!-- AUTO-GENERATED:DOCTRINE:END -->
|
|
72
46
|
|
|
73
47
|
## Getting Started
|
|
74
48
|
|
|
75
49
|
- To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
|
|
76
|
-
- 要查看中文 [指南](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
|
|
77
|
-
- [가이드](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)에서 확인하실 수 있습니다. 📚
|
|
78
|
-
- [ガイド](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)は [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)でご確認ください。 📚
|
|
79
|
-
- Para ver la [guía](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security), visita [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
|
|
80
|
-
- للاطلاع على [الدليل](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
|
|
81
50
|
|
|
82
51
|
```bash
|
|
83
52
|
npm install eslint-plugin-anthropic-security --save-dev
|
|
@@ -152,19 +121,52 @@ If this plugin caught a real bug for you, **[star the repo](https://github.com/o
|
|
|
152
121
|
|
|
153
122
|
<!-- INTERLACE:STAR_CTA:END -->
|
|
154
123
|
|
|
124
|
+
<!-- AUTO-GENERATED:ECOSYSTEM_TABLE:START - Do not edit manually -->
|
|
125
|
+
|
|
155
126
|
## 🔗 Related ESLint Plugins
|
|
156
127
|
|
|
157
|
-
Part of the **Interlace ESLint
|
|
128
|
+
Part of the **Interlace ESLint ecosystem** — AI-native rules with LLM-optimized error messages:
|
|
129
|
+
|
|
130
|
+
**Security**
|
|
158
131
|
|
|
159
132
|
| Plugin | Downloads | Description |
|
|
160
133
|
| :--- | :---: | :--- |
|
|
161
|
-
| [`eslint-plugin-
|
|
162
|
-
| [`eslint-plugin-
|
|
163
|
-
| [`eslint-plugin-
|
|
134
|
+
| [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [](https://www.npmjs.com/package/eslint-plugin-browser-security) | XSS, DOM security. |
|
|
135
|
+
| [`eslint-plugin-drizzle-security`](https://www.npmjs.com/package/eslint-plugin-drizzle-security) | [](https://www.npmjs.com/package/eslint-plugin-drizzle-security) | Drizzle security. |
|
|
136
|
+
| [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [](https://www.npmjs.com/package/eslint-plugin-express-security) | Express middleware hardening. |
|
|
164
137
|
| [`eslint-plugin-gemini-security`](https://www.npmjs.com/package/eslint-plugin-gemini-security) | [](https://www.npmjs.com/package/eslint-plugin-gemini-security) | Google Gemini SDK security. |
|
|
165
|
-
| [`eslint-plugin-
|
|
166
|
-
| [`eslint-plugin-
|
|
167
|
-
| [`eslint-plugin-
|
|
138
|
+
| [`eslint-plugin-jwt-security`](https://www.npmjs.com/package/eslint-plugin-jwt-security) | [](https://www.npmjs.com/package/eslint-plugin-jwt-security) | Token security. |
|
|
139
|
+
| [`eslint-plugin-knex-security`](https://www.npmjs.com/package/eslint-plugin-knex-security) | [](https://www.npmjs.com/package/eslint-plugin-knex-security) | Knex security. |
|
|
140
|
+
| [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda hardening. |
|
|
141
|
+
| [`eslint-plugin-mcp-sdk-security`](https://www.npmjs.com/package/eslint-plugin-mcp-sdk-security) | [](https://www.npmjs.com/package/eslint-plugin-mcp-sdk-security) | MCP SDK security. |
|
|
142
|
+
| [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB injection. |
|
|
143
|
+
| [`eslint-plugin-mysql-security`](https://www.npmjs.com/package/eslint-plugin-mysql-security) | [](https://www.npmjs.com/package/eslint-plugin-mysql-security) | MySQL security. |
|
|
144
|
+
| [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS framework hardening. |
|
|
145
|
+
| [`eslint-plugin-node-security`](https://www.npmjs.com/package/eslint-plugin-node-security) | [](https://www.npmjs.com/package/eslint-plugin-node-security) | Server-side patterns. |
|
|
146
|
+
| [`eslint-plugin-openai-security`](https://www.npmjs.com/package/eslint-plugin-openai-security) | [](https://www.npmjs.com/package/eslint-plugin-openai-security) | OpenAI SDK security. |
|
|
147
|
+
| [`eslint-plugin-postgresql-security`](https://www.npmjs.com/package/eslint-plugin-postgresql-security) | [](https://www.npmjs.com/package/eslint-plugin-postgresql-security) | PostgreSQL security. |
|
|
148
|
+
| [`eslint-plugin-prisma-security`](https://www.npmjs.com/package/eslint-plugin-prisma-security) | [](https://www.npmjs.com/package/eslint-plugin-prisma-security) | Prisma security. |
|
|
149
|
+
| [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [](https://www.npmjs.com/package/eslint-plugin-secure-coding) | Injection prevention. |
|
|
150
|
+
| [`eslint-plugin-sequelize-security`](https://www.npmjs.com/package/eslint-plugin-sequelize-security) | [](https://www.npmjs.com/package/eslint-plugin-sequelize-security) | Sequelize ORM security. |
|
|
151
|
+
| [`eslint-plugin-sqlite-security`](https://www.npmjs.com/package/eslint-plugin-sqlite-security) | [](https://www.npmjs.com/package/eslint-plugin-sqlite-security) | SQLite security. |
|
|
152
|
+
| [`eslint-plugin-typeorm-security`](https://www.npmjs.com/package/eslint-plugin-typeorm-security) | [](https://www.npmjs.com/package/eslint-plugin-typeorm-security) | TypeORM security. |
|
|
153
|
+
| [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | AI SDK security. |
|
|
154
|
+
|
|
155
|
+
**Code quality**
|
|
156
|
+
|
|
157
|
+
| Plugin | Downloads | Description |
|
|
158
|
+
| :--- | :---: | :--- |
|
|
159
|
+
| [`eslint-plugin-conventions`](https://www.npmjs.com/package/eslint-plugin-conventions) | [](https://www.npmjs.com/package/eslint-plugin-conventions) | Team-specific habits and styles. |
|
|
160
|
+
| [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [](https://www.npmjs.com/package/eslint-plugin-import-next) | Fast cycle + import-graph analysis. |
|
|
161
|
+
| [`eslint-plugin-maintainability`](https://www.npmjs.com/package/eslint-plugin-maintainability) | [](https://www.npmjs.com/package/eslint-plugin-maintainability) | Cognitive load and clean-code patterns. |
|
|
162
|
+
| [`eslint-plugin-modernization`](https://www.npmjs.com/package/eslint-plugin-modernization) | [](https://www.npmjs.com/package/eslint-plugin-modernization) | ESNext migration + syntax evolution. |
|
|
163
|
+
| [`eslint-plugin-modularity`](https://www.npmjs.com/package/eslint-plugin-modularity) | [](https://www.npmjs.com/package/eslint-plugin-modularity) | Structural integrity and DDD patterns. |
|
|
164
|
+
| [`eslint-plugin-operability`](https://www.npmjs.com/package/eslint-plugin-operability) | [](https://www.npmjs.com/package/eslint-plugin-operability) | Production readiness and resource health. |
|
|
165
|
+
| [`eslint-plugin-react-a11y`](https://www.npmjs.com/package/eslint-plugin-react-a11y) | [](https://www.npmjs.com/package/eslint-plugin-react-a11y) | React accessibility / WCAG. |
|
|
166
|
+
| [`eslint-plugin-react-features`](https://www.npmjs.com/package/eslint-plugin-react-features) | [](https://www.npmjs.com/package/eslint-plugin-react-features) | React best practices and optimization. |
|
|
167
|
+
| [`eslint-plugin-reliability`](https://www.npmjs.com/package/eslint-plugin-reliability) | [](https://www.npmjs.com/package/eslint-plugin-reliability) | Runtime stability and error safety. |
|
|
168
|
+
|
|
169
|
+
<!-- AUTO-GENERATED:ECOSYSTEM_TABLE:END -->
|
|
168
170
|
|
|
169
171
|
## 📄 License
|
|
170
172
|
|
|
@@ -175,5 +177,5 @@ MIT © [Ofri Peretz](https://github.com/ofri-peretz)
|
|
|
175
177
|
</p>
|
|
176
178
|
|
|
177
179
|
<p align="center">
|
|
178
|
-
<a href="https://eslint.interlace.tools
|
|
180
|
+
<a href="https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security" target="blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/interlace-dark.svg"><img src="https://eslint.interlace.tools/logos/interlace-light.svg" alt="Interlace" height="70" /></picture></a>
|
|
179
181
|
</p>
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "eslint-plugin-anthropic-security",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.4",
|
|
4
4
|
"description": "ESLint plugin for Anthropic SDK security — catches hardcoded Claude API keys, the browser escape hatch that ships them to every visitor, and system prompts assembled from untrusted input.",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -75,10 +75,19 @@
|
|
|
75
75
|
}
|
|
76
76
|
},
|
|
77
77
|
"dependencies": {
|
|
78
|
-
"@interlace/eslint-devkit": "^1.
|
|
78
|
+
"@interlace/eslint-devkit": "^1.18.2"
|
|
79
79
|
},
|
|
80
80
|
"funding": {
|
|
81
81
|
"type": "github",
|
|
82
82
|
"url": "https://github.com/ofri-peretz/eslint"
|
|
83
|
+
},
|
|
84
|
+
"interlace": {
|
|
85
|
+
"surface": {
|
|
86
|
+
"kind": "npm",
|
|
87
|
+
"modules": [
|
|
88
|
+
"@anthropic-ai/sdk",
|
|
89
|
+
"@anthropic-ai/claude-agent-sdk"
|
|
90
|
+
]
|
|
91
|
+
}
|
|
83
92
|
}
|
|
84
93
|
}
|
package/src/index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=exports.noUntrustedContentInPrompt=exports.noHardcodedApiKey=exports.noBrowserApiKeyExposure=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");var no_browser_api_key_exposure_2=require("./rules/no-browser-api-key-exposure");Object.defineProperty(exports,"noBrowserApiKeyExposure",{enumerable:true,get:function(){return no_browser_api_key_exposure_2.noBrowserApiKeyExposure}});var no_hardcoded_api_key_2=require("./rules/no-hardcoded-api-key");Object.defineProperty(exports,"noHardcodedApiKey",{enumerable:true,get:function(){return no_hardcoded_api_key_2.noHardcodedApiKey}});var no_untrusted_content_in_prompt_2=require("./rules/no-untrusted-content-in-prompt");Object.defineProperty(exports,"noUntrustedContentInPrompt",{enumerable:true,get:function(){return no_untrusted_content_in_prompt_2.noUntrustedContentInPrompt}});exports.rules={get"no-browser-api-key-exposure"(){return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure},get"no-hardcoded-api-key"(){return require("./rules/no-hardcoded-api-key").noHardcodedApiKey},get"no-untrusted-content-in-prompt"(){return require("./rules/no-untrusted-content-in-prompt").noUntrustedContentInPrompt}};(0,eslint_devkit_1.withCanonicalDocsUrls)("plugin-anthropic-security",exports.rules);exports.plugin={meta:{name:"eslint-plugin-anthropic-security",version:"0.3.
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=exports.noUntrustedContentInPrompt=exports.noHardcodedApiKey=exports.noBrowserApiKeyExposure=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");var no_browser_api_key_exposure_2=require("./rules/no-browser-api-key-exposure");Object.defineProperty(exports,"noBrowserApiKeyExposure",{enumerable:true,get:function(){return no_browser_api_key_exposure_2.noBrowserApiKeyExposure}});var no_hardcoded_api_key_2=require("./rules/no-hardcoded-api-key");Object.defineProperty(exports,"noHardcodedApiKey",{enumerable:true,get:function(){return no_hardcoded_api_key_2.noHardcodedApiKey}});var no_untrusted_content_in_prompt_2=require("./rules/no-untrusted-content-in-prompt");Object.defineProperty(exports,"noUntrustedContentInPrompt",{enumerable:true,get:function(){return no_untrusted_content_in_prompt_2.noUntrustedContentInPrompt}});exports.rules={get"no-browser-api-key-exposure"(){return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure},get"no-hardcoded-api-key"(){return require("./rules/no-hardcoded-api-key").noHardcodedApiKey},get"no-untrusted-content-in-prompt"(){return require("./rules/no-untrusted-content-in-prompt").noUntrustedContentInPrompt}};(0,eslint_devkit_1.withCanonicalDocsUrls)("plugin-anthropic-security",exports.rules);exports.plugin={meta:{name:"eslint-plugin-anthropic-security",version:"0.3.4"},rules:exports.rules};const enabled={plugins:{"anthropic-security":exports.plugin},rules:{"anthropic-security/no-browser-api-key-exposure":"error","anthropic-security/no-hardcoded-api-key":"error"}};const strict={plugins:{"anthropic-security":exports.plugin},rules:{...enabled.rules,"anthropic-security/no-untrusted-content-in-prompt":"error"}};exports.configs={minimal:enabled,recommended:enabled,strict};exports.default={...exports.plugin,configs:exports.configs};
|