eslint-plugin-crypto 1.0.0 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/AGENTS.md +83 -74
  2. package/README.md +13 -0
  3. package/package.json +10 -8
  4. package/LICENSE +0 -21
package/AGENTS.md CHANGED
@@ -1,12 +1,59 @@
1
- # AGENTS.md - AI Agent Context for eslint-plugin-crypto
1
+ # AGENTS.md
2
+
3
+ > Context for AI coding agents working on eslint-plugin-crypto
4
+
5
+ ## Setup Commands
6
+
7
+ ```bash
8
+ # Install dependencies (from monorepo root)
9
+ pnpm install
10
+
11
+ # Build this package
12
+ nx build eslint-plugin-crypto
13
+
14
+ # Run tests
15
+ nx test eslint-plugin-crypto
16
+
17
+ # Run tests with coverage
18
+ nx test eslint-plugin-crypto --coverage
19
+
20
+ # Lint this package
21
+ nx lint eslint-plugin-crypto
22
+ ```
23
+
24
+ ## Code Style
25
+
26
+ - TypeScript strict mode with `@interlace/eslint-devkit` types
27
+ - Use `AST_NODE_TYPES` constants, never string literals for node types
28
+ - Use `formatLLMMessage()` for all rule error messages
29
+ - Include CWE, CVSS, CVE references in every security message
30
+ - Use `c8 ignore` comments with documented reasons for untestable code
31
+ - Single-pass AST traversal patterns (O(n) complexity)
32
+
33
+ ## Testing Instructions
34
+
35
+ - Tests use `@typescript-eslint/rule-tester` with Vitest
36
+ - Each rule has `index.ts` (implementation) and `*.test.ts` (tests) in same directory
37
+ - Run specific rule test: `nx test eslint-plugin-crypto --testPathPattern="no-weak-hash"`
38
+ - Coverage target: ≥90% lines, ≥95% functions
39
+ - All tests must pass before committing
40
+
41
+ ## Project Structure
42
+
43
+ ```
44
+ src/
45
+ ├── index.ts # Plugin entry, 5 configs
46
+ ├── types/index.ts # 24 rule option types
47
+ └── rules/ # 24 rule directories
48
+ ```
2
49
 
3
50
  ## Plugin Purpose
4
51
 
5
52
  Security-focused ESLint plugin with **24 rules** for cryptographic best practices. Covers Node.js `crypto`, Web Crypto API, and npm packages (crypto-hash, crypto-random-string, crypto-js).
6
53
 
7
- ## Quick Reference
54
+ ## Rule Categories
8
55
 
9
- ### Core Crypto Rules (8)
56
+ ### Core Node.js Crypto Rules (8)
10
57
 
11
58
  | Rule | CWE | Detects | Fix |
12
59
  | ----------------------------- | --- | -------------- | ---------------- |
@@ -15,68 +62,40 @@ Security-focused ESLint plugin with **24 rules** for cryptographic best practice
15
62
  | `no-deprecated-cipher-method` | 327 | createCipher() | createCipheriv() |
16
63
  | `no-static-iv` | 329 | Hardcoded IVs | randomBytes(16) |
17
64
  | `no-ecb-mode` | 327 | ECB mode | GCM or CBC |
18
- | `no-insecure-key-derivation` | 916 | PBKDF2 < 100k | ≥100k iterations |
65
+ | `no-insecure-key-derivation` | 916 | PBKDF2 <100k | ≥100k iterations |
19
66
  | `no-hardcoded-crypto-key` | 321 | Literal keys | env vars/KMS |
20
67
  | `require-random-iv` | 329 | Non-random IVs | randomBytes() |
21
68
 
22
69
  ### CVE-Specific Rules (3)
23
70
 
24
- | Rule | CVE | Vulnerability |
25
- | ------------------------------ | ---------- | ------------- |
26
- | `no-insecure-rsa-padding` | 2023-46809 | Marvin Attack |
27
- | `no-cryptojs-weak-random` | 2020-36732 | Weak PRNG |
28
- | `require-secure-pbkdf2-digest` | 2023-46233 | SHA1 PBKDF2 |
29
-
30
- ### Advanced Security (7)
31
-
32
- | Rule | CWE | Focus |
33
- | ---------------------------------- | --- | --------------- |
34
- | `no-math-random-crypto` | 338 | Insecure PRNG |
35
- | `no-predictable-salt` | 331 | Weak salts |
36
- | `require-authenticated-encryption` | 327 | CBC without MAC |
37
- | `no-key-reuse` | 323 | Same key twice |
38
- | `no-self-signed-certs` | 295 | TLS bypass |
39
- | `no-timing-unsafe-compare` | 208 | Timing attacks |
40
- | `require-key-length` | 326 | AES-128/192 |
41
- | `no-web-crypto-export` | 321 | Key export |
42
-
43
- ### Package Rules (6)
44
-
45
- | Rule | Package | Issue |
46
- | --------------------------- | -------------------- | -------------- |
47
- | `no-sha1-hash` | crypto-hash | sha1() |
48
- | `require-sufficient-length` | crypto-random-string | < 32 chars |
49
- | `no-numeric-only-tokens` | crypto-random-string | Low entropy |
50
- | `no-cryptojs` | crypto-js | Deprecated |
51
- | `no-cryptojs-weak-random` | crypto-js | CVE-2020-36732 |
52
- | `prefer-native-crypto` | Various | Third-party |
53
-
54
- ## Fix Patterns
55
-
56
- ```diff
57
- # Weak Hash
58
- - crypto.createHash('md5')
59
- + crypto.createHash('sha256')
60
-
61
- # RSA Padding (CVE-2023-46809)
62
- - padding: crypto.constants.RSA_PKCS1_PADDING
63
- + padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
64
-
65
- # Math.random for crypto
66
- - const token = Math.random().toString(36)
67
- + const token = crypto.randomBytes(32).toString('hex')
68
-
69
- # Timing-safe compare
70
- - if (userToken === storedToken)
71
- + if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken)))
72
-
73
- # Authenticated encryption
74
- - crypto.createCipheriv('aes-256-cbc', key, iv)
75
- + crypto.createCipheriv('aes-256-gcm', key, iv)
76
-
77
- # TLS validation
78
- - { rejectUnauthorized: false }
79
- + { rejectUnauthorized: true }
71
+ | Rule | CVE | Vulnerability |
72
+ | ------------------------------ | -------------- | ------------- |
73
+ | `no-insecure-rsa-padding` | CVE-2023-46809 | Marvin Attack |
74
+ | `no-cryptojs-weak-random` | CVE-2020-36732 | Weak PRNG |
75
+ | `require-secure-pbkdf2-digest` | CVE-2023-46233 | SHA1 PBKDF2 |
76
+
77
+ ## Common Fix Patterns
78
+
79
+ ```typescript
80
+ // Weak Hash
81
+ // BAD: crypto.createHash('md5')
82
+ // GOOD: crypto.createHash('sha256')
83
+
84
+ // RSA Padding (CVE-2023-46809)
85
+ // BAD: padding: crypto.constants.RSA_PKCS1_PADDING
86
+ // GOOD: padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
87
+
88
+ // Math.random for crypto
89
+ // BAD: const token = Math.random().toString(36)
90
+ // GOOD: const token = crypto.randomBytes(32).toString('hex')
91
+
92
+ // Timing-safe compare
93
+ // BAD: if (userToken === storedToken)
94
+ // GOOD: if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken)))
95
+
96
+ // Authenticated encryption
97
+ // BAD: crypto.createCipheriv('aes-256-cbc', key, iv)
98
+ // GOOD: crypto.createCipheriv('aes-256-gcm', key, iv)
80
99
  ```
81
100
 
82
101
  ## Presets (5)
@@ -89,22 +108,12 @@ Security-focused ESLint plugin with **24 rules** for cryptographic best practice
89
108
  | `nodejs-only` | Server-side only |
90
109
  | `cve-focused` | Known CVE protection |
91
110
 
92
- ## Architecture
93
-
94
- ```
95
- src/
96
- ├── index.ts # Plugin entry, 5 configs
97
- ├── types/index.ts # 24 rule option types
98
- └── rules/ # 24 rule directories
99
- ├── no-weak-hash-algorithm/
100
- ├── no-insecure-rsa-padding/
101
- └── ...
102
- ```
103
-
104
111
  ## CWE Coverage
105
112
 
106
113
  208, 295, 321, 323, 326, 327, 328, 329, 330, 331, 338, 916, 1104
107
114
 
108
- ## Version
115
+ ## Security Considerations
109
116
 
110
- 1.0.0 (24 rules)
117
+ - Detects 3 specific CVEs: CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
118
+ - Marvin Attack detection for RSA padding
119
+ - crypto-js weak PRNG detection
package/README.md CHANGED
@@ -1,4 +1,5 @@
1
1
  # eslint-plugin-crypto
2
+ [![codecov](https://codecov.io/gh/ofri-peretz/eslint/graph/badge.svg?component=crypto)](https://app.codecov.io/gh/ofri-peretz/eslint/components?components%5B0%5D=crypto)
2
3
 
3
4
  > Security-focused ESLint plugin with **24 AI-parseable rules** for cryptographic best practices.
4
5
 
@@ -139,6 +140,18 @@ All rules include LLM-optimized error messages with:
139
140
  - Direct fix suggestions with code examples
140
141
  - Documentation links
141
142
 
143
+ ## 🔗 Related ESLint Plugins
144
+
145
+ Part of the **Forge-JS ESLint Ecosystem** — AI-native security plugins with LLM-optimized error messages:
146
+
147
+ | Plugin | Description | Rules |
148
+ | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | :---: |
149
+ | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | Universal security (OWASP Top 10 Web + Mobile) | 89 |
150
+ | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security (algorithm confusion, weak secrets, claims) | 13 |
151
+ | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL/node-postgres security | 13 |
152
+ | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security | 19 |
153
+ | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | High-performance import linting | 12 |
154
+
142
155
  ## License
143
156
 
144
157
  MIT © [Ofri Peretz](https://github.com/ofri-peretz)
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "eslint-plugin-crypto",
3
- "version": "1.0.0",
3
+ "version": "2.0.0",
4
4
  "description": "Security-focused ESLint plugin with 24 AI-parseable rules for cryptographic best practices. Detects weak algorithms, insecure key handling, CVE-specific vulnerabilities, and deprecated crypto patterns.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",
@@ -64,17 +64,19 @@
64
64
  },
65
65
  "dependencies": {
66
66
  "@interlace/eslint-devkit": "^1.2.1",
67
- "tslib": "^2.3.0"
67
+ "tslib": "^2.3.0",
68
+ "vitest": "^4.0.6",
69
+ "@nx/vite": "^22.0.3"
70
+ },
71
+ "scripts": {
72
+ "test": "vitest run",
73
+ "test:watch": "vitest watch",
74
+ "test:coverage": "vitest run --coverage"
68
75
  },
69
76
  "devDependencies": {
70
77
  "@typescript-eslint/parser": "^8.46.2",
71
78
  "@typescript-eslint/rule-tester": "^8.46.2",
72
79
  "@vitest/coverage-v8": "^4.0.6",
73
80
  "vitest": "^4.0.6"
74
- },
75
- "scripts": {
76
- "test": "vitest run",
77
- "test:watch": "vitest watch",
78
- "test:coverage": "vitest run --coverage"
79
81
  }
80
- }
82
+ }
package/LICENSE DELETED
@@ -1,21 +0,0 @@
1
- MIT License
2
-
3
- Copyright (c) 2025 Ofri Peretz
4
-
5
- Permission is hereby granted, free of charge, to any person obtaining a copy
6
- of this software and associated documentation files (the "Software"), to deal
7
- in the Software without restriction, including without limitation the rights
8
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
- copies of the Software, and to permit persons to whom the Software is
10
- furnished to do so, subject to the following conditions:
11
-
12
- The above copyright notice and this permission notice shall be included in all
13
- copies or substantial portions of the Software.
14
-
15
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
- SOFTWARE.