eslint-plugin-crypto 2.1.1 → 2.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. package/LICENSE +2 -0
  2. package/README.md +38 -76
  3. package/package.json +5 -5
  4. package/src/index.d.ts +1 -1
  5. package/src/index.js +21 -131
  6. package/src/rules/no-hardcoded-crypto-key/index.d.ts +3 -1
  7. package/src/rules/no-key-reuse/index.d.ts +3 -1
  8. package/src/rules/no-math-random-crypto/index.d.ts +3 -1
  9. package/src/rules/no-numeric-only-tokens/index.d.ts +3 -1
  10. package/src/rules/no-predictable-salt/index.d.ts +3 -1
  11. package/src/rules/no-web-crypto-export/index.d.ts +3 -1
  12. package/src/rules/require-authenticated-encryption/index.d.ts +3 -1
  13. package/src/rules/require-key-length/index.d.ts +3 -1
  14. package/src/rules/require-random-iv/index.d.ts +3 -1
  15. package/src/rules/require-secure-pbkdf2-digest/index.d.ts +3 -1
  16. package/src/rules/require-sufficient-length/index.d.ts +3 -1
  17. package/AGENTS.md +0 -119
  18. package/CHANGELOG.md +0 -74
  19. package/src/rules/no-cryptojs/index.d.ts +0 -22
  20. package/src/rules/no-cryptojs/index.js +0 -103
  21. package/src/rules/no-cryptojs-weak-random/index.d.ts +0 -22
  22. package/src/rules/no-cryptojs-weak-random/index.js +0 -111
  23. package/src/rules/no-deprecated-cipher-method/index.d.ts +0 -21
  24. package/src/rules/no-deprecated-cipher-method/index.js +0 -117
  25. package/src/rules/no-ecb-mode/index.d.ts +0 -21
  26. package/src/rules/no-ecb-mode/index.js +0 -112
  27. package/src/rules/no-insecure-key-derivation/index.d.ts +0 -22
  28. package/src/rules/no-insecure-key-derivation/index.js +0 -115
  29. package/src/rules/no-insecure-rsa-padding/index.d.ts +0 -22
  30. package/src/rules/no-insecure-rsa-padding/index.js +0 -109
  31. package/src/rules/no-self-signed-certs/index.d.ts +0 -21
  32. package/src/rules/no-self-signed-certs/index.js +0 -115
  33. package/src/rules/no-sha1-hash/index.d.ts +0 -22
  34. package/src/rules/no-sha1-hash/index.js +0 -127
  35. package/src/rules/no-static-iv/index.d.ts +0 -21
  36. package/src/rules/no-static-iv/index.js +0 -146
  37. package/src/rules/no-timing-unsafe-compare/index.d.ts +0 -21
  38. package/src/rules/no-timing-unsafe-compare/index.js +0 -113
  39. package/src/rules/no-weak-cipher-algorithm/index.d.ts +0 -23
  40. package/src/rules/no-weak-cipher-algorithm/index.js +0 -189
  41. package/src/rules/no-weak-hash-algorithm/index.d.ts +0 -23
  42. package/src/rules/no-weak-hash-algorithm/index.js +0 -217
  43. package/src/rules/prefer-native-crypto/index.d.ts +0 -21
  44. package/src/rules/prefer-native-crypto/index.js +0 -123
package/LICENSE CHANGED
@@ -19,3 +19,5 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
19
  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
20
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
21
  SOFTWARE.
22
+
23
+
package/README.md CHANGED
@@ -16,7 +16,8 @@
16
16
 
17
17
  ## Description
18
18
 
19
- This plugin enforces cryptographic best practices and modern security standards specifically for Node.js environments. It assists developers in avoiding weak algorithms and insecure implementations by flagging potential risks directly in the code. By integrating these checks, you can ensure that your application's data protection measures are robust and compliant with industry standards.
19
+ This plugin provides Cryptographic security rules enforcing best practices and modern standards (Node.js crypto).
20
+ By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.
20
21
 
21
22
  ## Philosophy
22
23
 
@@ -36,7 +37,6 @@ npm install eslint-plugin-crypto --save-dev
36
37
  ```
37
38
 
38
39
  ## 💡 What You Get
39
-
40
40
  - **24 security rules** covering cryptographic best practices
41
41
  - **CVE detection** for CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
42
42
  - **OWASP Top 10 coverage** for cryptographic vulnerabilities
@@ -44,7 +44,6 @@ npm install eslint-plugin-crypto --save-dev
44
44
  - **Package support** for crypto-hash, crypto-random-string, crypto-js
45
45
 
46
46
  ## Features
47
-
48
47
  - 🔐 **24 Rules** covering crypto best practices
49
48
  - 🎯 **CVE Detection** (CVE-2023-46809, CVE-2020-36732, CVE-2023-46233)
50
49
  - 🤖 **AI-Optimized** messages with CWE references
@@ -52,7 +51,6 @@ npm install eslint-plugin-crypto --save-dev
52
51
  - 📦 **Package Support** for crypto-hash, crypto-random-string, crypto-js
53
52
 
54
53
  ## ⚙️ Configuration Presets
55
-
56
54
  | Preset | Description |
57
55
  | :------------------- | :------------------------------------------- |
58
56
  | `recommended` | Balanced security defaults for most projects |
@@ -62,14 +60,12 @@ npm install eslint-plugin-crypto --save-dev
62
60
  | `cve-focused` | Rules targeting specific CVEs |
63
61
 
64
62
  ## 📚 Supported Libraries
65
-
66
63
  | Library | npm | Downloads | Detection |
67
64
  | ------------------ | ------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
68
65
  | `crypto` (Node.js) | [![node](https://img.shields.io/badge/node-built--in-green?style=flat-square)](https://nodejs.org/api/crypto.html) | - | Weak Algo, Key Length, Randomness |
69
66
  | `crypto-js` | [![npm](https://img.shields.io/npm/v/crypto-js.svg?style=flat-square)](https://www.npmjs.com/package/crypto-js) | [![downloads](https://img.shields.io/npm/dt/crypto-js.svg?style=flat-square)](https://www.npmjs.com/package/crypto-js) | Legacy patterns, Weak PRNG |
70
67
 
71
68
  ## Examples
72
-
73
69
  ### ❌ Bad
74
70
 
75
71
  ```javascript
@@ -103,7 +99,6 @@ if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) {
103
99
  ```
104
100
 
105
101
  ## Peer Dependencies (Optional)
106
-
107
102
  ```json
108
103
  {
109
104
  "crypto-hash": ">=3.0.0",
@@ -112,87 +107,54 @@ if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) {
112
107
  }
113
108
  ```
114
109
 
115
- ## AI-Optimized Messages
116
-
117
- This plugin is optimized for ESLint's [Model Context Protocol (MCP)](https://eslint.org/docs/latest/use/mcp), enabling AI assistants like **Cursor**, **GitHub Copilot**, and **Claude** to:
118
-
119
- - Understand the exact vulnerability type via CWE references
120
- - Apply the correct fix using structured guidance
121
- - Provide educational context to developers
122
-
123
- ```json
124
- // .cursor/mcp.json
125
- {
126
- "mcpServers": {
127
- "eslint": {
128
- "command": "npx",
129
- "args": ["@eslint/mcp@latest"]
130
- }
131
- }
132
- }
133
- ```
134
-
135
- By providing this structured context (CWE, OWASP, Fix), we enable AI tools to **reason** about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the _exact_ correct fix immediately.
136
-
137
110
  ## Rules
138
111
 
139
112
  **Legend**
140
113
 
141
- | Icon | Description |
142
- | :--: | :----------------------------------------------------------------- |
143
- | 💼 | **Recommended**: Included in the recommended preset. |
144
- | ⚠️ | **Warns**: Set towarn in recommended preset. |
145
- | 🔧 | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
146
- | 💡 | **Suggestions**: Providing code suggestions in IDE. |
147
- | 🚫 | **Deprecated**: This rule is deprecated. |
148
-
149
- | Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
150
- | :-------------------------------------------------------------------------------------------------------------------- | :-----: | :------: | :--: | :--------------------------------------------------------------------------------- | :-: | :-: | :-: | :-: | :-: |
151
- | [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/crypto/rules/no-weak-hash-algorithm) | CWE-327 | A02:2025 | 7.5 | [no-weak-hash-algorithm](docs/rules/no-weak-hash-algorithm.md) | 💼 | | | 💡 | |
152
- | [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/crypto/rules/no-weak-cipher-algorithm) | CWE-327 | A02:2025 | 7.5 | [no-weak-cipher-algorithm](docs/rules/no-weak-cipher-algorithm.md) | 💼 | | | 💡 | |
153
- | [no-deprecated-cipher-method](https://eslint.interlace.tools/docs/crypto/rules/no-deprecated-cipher-method) | CWE-327 | A02:2025 | 5.0 | [no-deprecated-cipher-method](docs/rules/no-deprecated-cipher-method.md) | 💼 | | | 💡 | |
154
- | [no-static-iv](https://eslint.interlace.tools/docs/crypto/rules/no-static-iv) | CWE-329 | A02:2025 | 7.5 | [no-static-iv](docs/rules/no-static-iv.md) | 💼 | | | 💡 | |
155
- | [no-ecb-mode](https://eslint.interlace.tools/docs/crypto/rules/no-ecb-mode) | CWE-327 | A02:2025 | 7.5 | [no-ecb-mode](docs/rules/no-ecb-mode.md) | 💼 | | | 💡 | |
156
- | [no-insecure-key-derivation](https://eslint.interlace.tools/docs/crypto/rules/no-insecure-key-derivation) | CWE-916 | A02:2025 | 7.5 | [no-insecure-key-derivation](docs/rules/no-insecure-key-derivation.md) | 💼 | | | 💡 | |
157
- | [no-hardcoded-crypto-key](https://eslint.interlace.tools/docs/crypto/rules/no-hardcoded-crypto-key) | CWE-321 | A02:2025 | 9.8 | [no-hardcoded-crypto-key](docs/rules/no-hardcoded-crypto-key.md) | 💼 | | | 💡 | |
158
- | [require-random-iv](https://eslint.interlace.tools/docs/crypto/rules/require-random-iv) | CWE-329 | A02:2025 | 7.5 | [require-random-iv](docs/rules/require-random-iv.md) | 💼 | ⚠️ | | 💡 | |
159
- | [no-insecure-rsa-padding](https://eslint.interlace.tools/docs/crypto/rules/no-insecure-rsa-padding) | CWE-327 | A02:2025 | 7.4 | [no-insecure-rsa-padding](docs/rules/no-insecure-rsa-padding.md) | 💼 | | | 💡 | |
160
- | [no-cryptojs-weak-random](https://eslint.interlace.tools/docs/crypto/rules/no-cryptojs-weak-random) | CWE-338 | A02:2025 | 5.3 | [no-cryptojs-weak-random](docs/rules/no-cryptojs-weak-random.md) | 💼 | | | 💡 | |
161
- | [require-secure-pbkdf2-digest](https://eslint.interlace.tools/docs/crypto/rules/require-secure-pbkdf2-digest) | CWE-916 | A02:2025 | 9.1 | [require-secure-pbkdf2-digest](docs/rules/require-secure-pbkdf2-digest.md) | 💼 | | | 💡 | |
162
- | [no-math-random-crypto](https://eslint.interlace.tools/docs/crypto/rules/no-math-random-crypto) | CWE-338 | A07:2025 | 5.3 | [no-math-random-crypto](docs/rules/no-math-random-crypto.md) | 💼 | | | 💡 | |
163
- | [no-predictable-salt](https://eslint.interlace.tools/docs/crypto/rules/no-predictable-salt) | CWE-331 | A07:2025 | 7.5 | [no-predictable-salt](docs/rules/no-predictable-salt.md) | 💼 | | | 💡 | |
164
- | [require-authenticated-encryption](https://eslint.interlace.tools/docs/crypto/rules/require-authenticated-encryption) | CWE-327 | A04:2025 | 6.5 | [require-authenticated-encryption](docs/rules/require-authenticated-encryption.md) | 💼 | ⚠️ | | 💡 | |
165
- | [no-key-reuse](https://eslint.interlace.tools/docs/crypto/rules/no-key-reuse) | CWE-323 | A02:2025 | 7.5 | [no-key-reuse](docs/rules/no-key-reuse.md) | 💼 | ⚠️ | | 💡 | |
166
- | [no-self-signed-certs](https://eslint.interlace.tools/docs/crypto/rules/no-self-signed-certs) | CWE-295 | A05:2025 | 7.5 | [no-self-signed-certs](docs/rules/no-self-signed-certs.md) | 💼 | | | 💡 | |
167
- | [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/crypto/rules/no-timing-unsafe-compare) | CWE-208 | A02:2025 | 5.9 | [no-timing-unsafe-compare](docs/rules/no-timing-unsafe-compare.md) | 💼 | ⚠️ | | 💡 | |
168
- | [require-key-length](https://eslint.interlace.tools/docs/crypto/rules/require-key-length) | CWE-326 | A02:2025 | 7.5 | [require-key-length](docs/rules/require-key-length.md) | 💼 | ⚠️ | | 💡 | |
169
- | [no-web-crypto-export](https://eslint.interlace.tools/docs/crypto/rules/no-web-crypto-export) | CWE-321 | A02:2025 | 5.0 | [no-web-crypto-export](docs/rules/no-web-crypto-export.md) | 💼 | ⚠️ | | 💡 | |
170
- | [no-sha1-hash](https://eslint.interlace.tools/docs/crypto/rules/no-sha1-hash) | CWE-327 | A02:2025 | 7.5 | [no-sha1-hash](docs/rules/no-sha1-hash.md) | 💼 | | | 💡 | |
171
- | [require-sufficient-length](https://eslint.interlace.tools/docs/crypto/rules/require-sufficient-length) | CWE-326 | A02:2025 | 7.5 | [require-sufficient-length](docs/rules/require-sufficient-length.md) | 💼 | ⚠️ | | 💡 | |
172
- | [no-numeric-only-tokens](https://eslint.interlace.tools/docs/crypto/rules/no-numeric-only-tokens) | CWE-330 | A07:2025 | 5.3 | [no-numeric-only-tokens](docs/rules/no-numeric-only-tokens.md) | 💼 | ⚠️ | | 💡 | |
173
- | [no-cryptojs](https://eslint.interlace.tools/docs/crypto/rules/no-cryptojs) | CWE-327 | A02:2025 | 5.0 | [no-cryptojs](docs/rules/no-cryptojs.md) | 💼 | ⚠️ | | 💡 | |
174
- | [prefer-native-crypto](https://eslint.interlace.tools/docs/crypto/rules/prefer-native-crypto) | CWE-327 | A05:2025 | 5.0 | [prefer-native-crypto](docs/rules/prefer-native-crypto.md) | 💼 | ⚠️ | | 💡 | |
114
+ | Icon | Description |
115
+ | :---: | :--- |
116
+ | 💼 | **Recommended**: Included in the recommended preset. |
117
+ | ⚠️ | **Warns**: Set towarn in recommended preset. |
118
+ | 🔧 | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
119
+ | 💡 | **Suggestions**: Providing code suggestions in IDE. |
120
+ | 🚫 | **Deprecated**: This rule is deprecated. |
121
+
122
+ | Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
123
+ | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: |
124
+ | [no-hardcoded-crypto-key](https://eslint.interlace.tools/docs/crypto/rules/no-hardcoded-crypto-key) | CWE-321 | A02:2025 | 9.8 | Enforce no hardcoded crypto key | 💼 | | | 💡 | |
125
+ | [no-key-reuse](https://eslint.interlace.tools/docs/crypto/rules/no-key-reuse) | CWE-323 | A02:2025 | 7.5 | Enforce no key reuse | 💼 | ⚠️ | | 💡 | |
126
+ | [no-math-random-crypto](https://eslint.interlace.tools/docs/crypto/rules/no-math-random-crypto) | CWE-338 | A07:2025 | 5.3 | Enforce no math random crypto | 💼 | | | 💡 | |
127
+ | [no-numeric-only-tokens](https://eslint.interlace.tools/docs/crypto/rules/no-numeric-only-tokens) | CWE-330 | A07:2025 | 5.3 | Enforce no numeric only tokens | 💼 | ⚠️ | | 💡 | |
128
+ | [no-predictable-salt](https://eslint.interlace.tools/docs/crypto/rules/no-predictable-salt) | CWE-331 | A07:2025 | 7.5 | Enforce no predictable salt | 💼 | | | 💡 | |
129
+ | [no-web-crypto-export](https://eslint.interlace.tools/docs/crypto/rules/no-web-crypto-export) | CWE-321 | A02:2025 | 5.0 | Enforce no web crypto export | 💼 | ⚠️ | | 💡 | |
130
+ | [require-authenticated-encryption](https://eslint.interlace.tools/docs/crypto/rules/require-authenticated-encryption) | CWE-327 | A04:2025 | 6.5 | Enforce require authenticated encryption | 💼 | ⚠️ | | 💡 | |
131
+ | [require-key-length](https://eslint.interlace.tools/docs/crypto/rules/require-key-length) | CWE-326 | A02:2025 | 7.5 | Enforce require key length | 💼 | ⚠️ | | 💡 | |
132
+ | [require-random-iv](https://eslint.interlace.tools/docs/crypto/rules/require-random-iv) | CWE-329 | A02:2025 | 7.5 | Enforce require random iv | 💼 | ⚠️ | | 💡 | |
133
+ | [require-secure-pbkdf2-digest](https://eslint.interlace.tools/docs/crypto/rules/require-secure-pbkdf2-digest) | CWE-916 | A02:2025 | 9.1 | Enforce require secure pbkdf2 digest | 💼 | | | 💡 | |
134
+ | [require-sufficient-length](https://eslint.interlace.tools/docs/crypto/rules/require-sufficient-length) | CWE-326 | A02:2025 | 7.5 | Enforce require sufficient length | 💼 | ⚠️ | | 💡 | |
175
135
 
176
136
  ## 🔗 Related ESLint Plugins
177
137
 
178
138
  Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with LLM-optimized error messages:
179
139
 
180
- | Plugin | Downloads | Description |
181
- | :--------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :------------------------------------------ |
182
- | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
183
- | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
184
- | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
185
- | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
186
- | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security rules. |
187
- | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
188
- | [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-lambda-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
189
- | [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-nestjs-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
190
- | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
140
+ | Plugin | Downloads | Description |
141
+ | :--- | :---: | :--- |
142
+ | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
143
+ | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
144
+ | [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-crypto.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
145
+ | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
146
+ | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
147
+ | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
148
+ | [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-lambda-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
149
+ | [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-nestjs-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
150
+ | [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-mongodb-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB security best practices. |
151
+ | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
152
+ | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
191
153
 
192
154
  ## 📄 License
193
155
 
194
156
  MIT © [Ofri Peretz](https://github.com/ofri-peretz)
195
157
 
196
158
  <p align="center">
197
- <a href="https://eslint.interlace.tools/docs/crypto"><img src="https://eslint.interlace.tools/images/og-crypto.png" alt="ESLint Interlace Plugin" width="300" /></a>
198
- </p>
159
+ <a href="https://eslint.interlace.tools/docs/crypto"><img src="https://eslint.interlace.tools/images/og-crypto.png" alt="ESLint Interlace Plugin" width="100%" /></a>
160
+ </p>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "eslint-plugin-crypto",
3
- "version": "2.1.1",
3
+ "version": "2.2.1",
4
4
  "description": "Security-focused ESLint plugin with 24 AI-parseable rules for cryptographic best practices. Detects weak algorithms, insecure key handling, CVE-specific vulnerabilities, and deprecated crypto patterns.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",
@@ -17,10 +17,10 @@
17
17
  },
18
18
  "author": "Ofri Peretz <ofriperetzdev@gmail.com>",
19
19
  "license": "MIT",
20
- "homepage": "https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-crypto/README.md",
20
+ "homepage": "https://github.com/ofri-peretz/eslint/tree/main/packages/eslint-plugin-crypto#readme",
21
21
  "repository": {
22
22
  "type": "git",
23
- "url": "git+https://github.com/ofri-peretz/eslint.git",
23
+ "url": "https://github.com/ofri-peretz/eslint",
24
24
  "directory": "packages/eslint-plugin-crypto"
25
25
  },
26
26
  "bugs": {
@@ -63,8 +63,8 @@
63
63
  "node": ">=18.0.0"
64
64
  },
65
65
  "dependencies": {
66
- "@interlace/eslint-devkit": "^1.2.1",
67
- "tslib": "^2.3.0"
66
+ "tslib": "^2.3.0",
67
+ "@interlace/eslint-devkit": "^1.2.1"
68
68
  },
69
69
  "devDependencies": {
70
70
  "@typescript-eslint/parser": "^8.46.2",
package/src/index.d.ts CHANGED
@@ -5,7 +5,7 @@
5
5
  */
6
6
  import type { TSESLint } from '@interlace/eslint-devkit';
7
7
  /**
8
- * Collection of all crypto security rules (24 total)
8
+ * Collection of crypto security rules (11 remaining in this deprecated plugin)
9
9
  */
10
10
  export declare const rules: Record<string, TSESLint.RuleModule<string, readonly unknown[]>>;
11
11
  /**
package/src/index.js CHANGED
@@ -10,79 +10,43 @@ const tslib_1 = require("tslib");
10
10
  /**
11
11
  * eslint-plugin-crypto
12
12
  *
13
- * Security-focused ESLint plugin with 24 rules for cryptographic best practices.
14
- * Covers Node.js crypto, crypto-hash, crypto-random-string, cryptojs, and Web Crypto.
13
+ * ⛔ DEPRECATED: This plugin is being phased out.
14
+ * Rules have been redistributed to:
15
+ * - node-security (18 rules for node:crypto hardening)
16
+ * - browser-security (1 rule for Web Crypto API)
17
+ * - secure-coding (5 rules for general crypto patterns)
15
18
  *
16
- * Features:
17
- * - LLM-optimized error messages with CWE references
18
- * - Auto-fix suggestions where safe
19
- * - OWASP-aligned recommendations
20
- * - CVE-specific detection (CVE-2023-46809, CVE-2020-36732, CVE-2023-46233)
19
+ * This plugin now contains only the remaining local rules.
21
20
  *
22
21
  * @see https://github.com/ofri-peretz/eslint/tree/main/packages/eslint-plugin-crypto
23
22
  */
24
- // Core Node.js crypto rules
25
- const no_weak_hash_algorithm_1 = require("./rules/no-weak-hash-algorithm");
26
- const no_weak_cipher_algorithm_1 = require("./rules/no-weak-cipher-algorithm");
27
- const no_deprecated_cipher_method_1 = require("./rules/no-deprecated-cipher-method");
28
- const no_static_iv_1 = require("./rules/no-static-iv");
29
- const no_ecb_mode_1 = require("./rules/no-ecb-mode");
30
- const no_insecure_key_derivation_1 = require("./rules/no-insecure-key-derivation");
23
+ // Local rules that still exist in this plugin
31
24
  const no_hardcoded_crypto_key_1 = require("./rules/no-hardcoded-crypto-key");
32
- const require_random_iv_1 = require("./rules/require-random-iv");
33
- // crypto-hash package rules
34
- const no_sha1_hash_1 = require("./rules/no-sha1-hash");
35
- // crypto-random-string package rules
36
- const require_sufficient_length_1 = require("./rules/require-sufficient-length");
37
- const no_numeric_only_tokens_1 = require("./rules/no-numeric-only-tokens");
38
- // cryptojs package rules
39
- const no_cryptojs_1 = require("./rules/no-cryptojs");
40
- const no_cryptojs_weak_random_1 = require("./rules/no-cryptojs-weak-random");
41
- const prefer_native_crypto_1 = require("./rules/prefer-native-crypto");
42
- // NEW: CVE and advanced security rules
25
+ const no_key_reuse_1 = require("./rules/no-key-reuse");
43
26
  const no_math_random_crypto_1 = require("./rules/no-math-random-crypto");
44
- const no_insecure_rsa_padding_1 = require("./rules/no-insecure-rsa-padding");
45
- const require_secure_pbkdf2_digest_1 = require("./rules/require-secure-pbkdf2-digest");
27
+ const no_numeric_only_tokens_1 = require("./rules/no-numeric-only-tokens");
46
28
  const no_predictable_salt_1 = require("./rules/no-predictable-salt");
29
+ const no_web_crypto_export_1 = require("./rules/no-web-crypto-export");
47
30
  const require_authenticated_encryption_1 = require("./rules/require-authenticated-encryption");
48
- const no_key_reuse_1 = require("./rules/no-key-reuse");
49
- const no_self_signed_certs_1 = require("./rules/no-self-signed-certs");
50
- const no_timing_unsafe_compare_1 = require("./rules/no-timing-unsafe-compare");
51
31
  const require_key_length_1 = require("./rules/require-key-length");
52
- const no_web_crypto_export_1 = require("./rules/no-web-crypto-export");
32
+ const require_random_iv_1 = require("./rules/require-random-iv");
33
+ const require_secure_pbkdf2_digest_1 = require("./rules/require-secure-pbkdf2-digest");
34
+ const require_sufficient_length_1 = require("./rules/require-sufficient-length");
53
35
  /**
54
- * Collection of all crypto security rules (24 total)
36
+ * Collection of crypto security rules (11 remaining in this deprecated plugin)
55
37
  */
56
38
  exports.rules = {
57
- // Core Node.js crypto rules (8)
58
- 'no-weak-hash-algorithm': no_weak_hash_algorithm_1.noWeakHashAlgorithm,
59
- 'no-weak-cipher-algorithm': no_weak_cipher_algorithm_1.noWeakCipherAlgorithm,
60
- 'no-deprecated-cipher-method': no_deprecated_cipher_method_1.noDeprecatedCipherMethod,
61
- 'no-static-iv': no_static_iv_1.noStaticIv,
62
- 'no-ecb-mode': no_ecb_mode_1.noEcbMode,
63
- 'no-insecure-key-derivation': no_insecure_key_derivation_1.noInsecureKeyDerivation,
64
39
  'no-hardcoded-crypto-key': no_hardcoded_crypto_key_1.noHardcodedCryptoKey,
65
- 'require-random-iv': require_random_iv_1.requireRandomIv,
66
- // crypto-hash package rules (1)
67
- 'no-sha1-hash': no_sha1_hash_1.noSha1Hash,
68
- // crypto-random-string package rules (2)
69
- 'require-sufficient-length': require_sufficient_length_1.requireSufficientLength,
70
- 'no-numeric-only-tokens': no_numeric_only_tokens_1.noNumericOnlyTokens,
71
- // cryptojs package rules (3)
72
- 'no-cryptojs': no_cryptojs_1.noCryptojs,
73
- 'no-cryptojs-weak-random': no_cryptojs_weak_random_1.noCryptojsWeakRandom,
74
- 'prefer-native-crypto': prefer_native_crypto_1.preferNativeCrypto,
75
- // Advanced security rules (10)
40
+ 'no-key-reuse': no_key_reuse_1.noKeyReuse,
76
41
  'no-math-random-crypto': no_math_random_crypto_1.noMathRandomCrypto,
77
- 'no-insecure-rsa-padding': no_insecure_rsa_padding_1.noInsecureRsaPadding,
78
- 'require-secure-pbkdf2-digest': require_secure_pbkdf2_digest_1.requireSecurePbkdf2Digest,
42
+ 'no-numeric-only-tokens': no_numeric_only_tokens_1.noNumericOnlyTokens,
79
43
  'no-predictable-salt': no_predictable_salt_1.noPredictableSalt,
44
+ 'no-web-crypto-export': no_web_crypto_export_1.noWebCryptoExport,
80
45
  'require-authenticated-encryption': require_authenticated_encryption_1.requireAuthenticatedEncryption,
81
- 'no-key-reuse': no_key_reuse_1.noKeyReuse,
82
- 'no-self-signed-certs': no_self_signed_certs_1.noSelfSignedCerts,
83
- 'no-timing-unsafe-compare': no_timing_unsafe_compare_1.noTimingUnsafeCompare,
84
46
  'require-key-length': require_key_length_1.requireKeyLength,
85
- 'no-web-crypto-export': no_web_crypto_export_1.noWebCryptoExport,
47
+ 'require-random-iv': require_random_iv_1.requireRandomIv,
48
+ 'require-secure-pbkdf2-digest': require_secure_pbkdf2_digest_1.requireSecurePbkdf2Digest,
49
+ 'require-sufficient-length': require_sufficient_length_1.requireSufficientLength,
86
50
  };
87
51
  /**
88
52
  * ESLint Plugin object
@@ -98,33 +62,17 @@ exports.plugin = {
98
62
  * Recommended rules - balanced between security and practicality
99
63
  */
100
64
  const recommendedRules = {
101
- // Critical - Always error
102
- 'crypto/no-weak-hash-algorithm': 'error',
103
- 'crypto/no-weak-cipher-algorithm': 'error',
104
- 'crypto/no-deprecated-cipher-method': 'error',
105
65
  'crypto/no-hardcoded-crypto-key': 'error',
106
- 'crypto/no-ecb-mode': 'error',
107
- 'crypto/no-cryptojs-weak-random': 'error',
108
66
  'crypto/no-math-random-crypto': 'error',
109
- 'crypto/no-insecure-rsa-padding': 'error',
110
- 'crypto/no-self-signed-certs': 'error',
111
- // High - Error for most projects
112
- 'crypto/no-static-iv': 'error',
113
- 'crypto/no-insecure-key-derivation': 'error',
114
- 'crypto/require-random-iv': 'warn',
115
- 'crypto/no-sha1-hash': 'error',
116
67
  'crypto/require-secure-pbkdf2-digest': 'error',
117
68
  'crypto/no-predictable-salt': 'error',
118
- 'crypto/no-timing-unsafe-compare': 'warn',
119
- // Medium - Warnings
120
69
  'crypto/require-sufficient-length': 'warn',
121
70
  'crypto/no-numeric-only-tokens': 'warn',
122
- 'crypto/no-cryptojs': 'warn',
123
- 'crypto/prefer-native-crypto': 'warn',
124
71
  'crypto/require-authenticated-encryption': 'warn',
125
72
  'crypto/no-key-reuse': 'warn',
126
73
  'crypto/require-key-length': 'warn',
127
74
  'crypto/no-web-crypto-export': 'warn',
75
+ 'crypto/require-random-iv': 'warn',
128
76
  };
129
77
  /**
130
78
  * Preset configurations
@@ -148,64 +96,6 @@ exports.configs = {
148
96
  },
149
97
  rules: Object.fromEntries(Object.keys(exports.rules).map(ruleName => [`crypto/${ruleName}`, 'error'])),
150
98
  },
151
- /**
152
- * CryptoJS migration configuration
153
- * For teams migrating from crypto-js to native crypto
154
- */
155
- 'cryptojs-migration': {
156
- plugins: {
157
- crypto: exports.plugin,
158
- },
159
- rules: {
160
- 'crypto/no-cryptojs': 'error',
161
- 'crypto/no-cryptojs-weak-random': 'error',
162
- 'crypto/prefer-native-crypto': 'error',
163
- },
164
- },
165
- /**
166
- * Node.js-only configuration
167
- * Only Node.js crypto rules, no package-specific rules
168
- */
169
- 'nodejs-only': {
170
- plugins: {
171
- crypto: exports.plugin,
172
- },
173
- rules: {
174
- 'crypto/no-weak-hash-algorithm': 'error',
175
- 'crypto/no-weak-cipher-algorithm': 'error',
176
- 'crypto/no-deprecated-cipher-method': 'error',
177
- 'crypto/no-static-iv': 'error',
178
- 'crypto/no-ecb-mode': 'error',
179
- 'crypto/no-insecure-key-derivation': 'error',
180
- 'crypto/no-hardcoded-crypto-key': 'error',
181
- 'crypto/require-random-iv': 'warn',
182
- 'crypto/no-math-random-crypto': 'error',
183
- 'crypto/no-insecure-rsa-padding': 'error',
184
- 'crypto/require-secure-pbkdf2-digest': 'error',
185
- 'crypto/no-predictable-salt': 'error',
186
- 'crypto/require-authenticated-encryption': 'warn',
187
- 'crypto/no-key-reuse': 'warn',
188
- 'crypto/no-self-signed-certs': 'error',
189
- 'crypto/no-timing-unsafe-compare': 'warn',
190
- 'crypto/require-key-length': 'warn',
191
- },
192
- },
193
- /**
194
- * CVE-focused configuration
195
- * Rules specifically targeting known CVEs
196
- */
197
- 'cve-focused': {
198
- plugins: {
199
- crypto: exports.plugin,
200
- },
201
- rules: {
202
- 'crypto/no-insecure-rsa-padding': 'error', // CVE-2023-46809 (Marvin Attack)
203
- 'crypto/no-cryptojs-weak-random': 'error', // CVE-2020-36732
204
- 'crypto/require-secure-pbkdf2-digest': 'error', // CVE-2023-46233
205
- 'crypto/no-weak-hash-algorithm': 'error', // Various CVEs
206
- 'crypto/no-weak-cipher-algorithm': 'error', // Various CVEs
207
- },
208
- },
209
99
  };
210
100
  /**
211
101
  * Default export for ESLint plugin
package/src/rules/no-hardcoded-crypto-key/index.d.ts CHANGED
@@ -17,5 +17,7 @@ export interface Options {
17
17
  allowInTests?: boolean;
18
18
  }
19
19
  type RuleOptions = [Options?];
20
- export declare const noHardcodedCryptoKey: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
20
+ export declare const noHardcodedCryptoKey: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
21
+ name: string;
22
+ };
21
23
  export type { Options as NoHardcodedCryptoKeyOptions };
package/src/rules/no-key-reuse/index.d.ts CHANGED
@@ -17,5 +17,7 @@ export interface Options {
17
17
  allowInTests?: boolean;
18
18
  }
19
19
  type RuleOptions = [Options?];
20
- export declare const noKeyReuse: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
20
+ export declare const noKeyReuse: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
21
+ name: string;
22
+ };
21
23
  export type { Options as NoKeyReuseOptions };
package/src/rules/no-math-random-crypto/index.d.ts CHANGED
@@ -20,5 +20,7 @@ export interface Options {
20
20
  allowInTests?: boolean;
21
21
  }
22
22
  type RuleOptions = [Options?];
23
- export declare const noMathRandomCrypto: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
23
+ export declare const noMathRandomCrypto: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
24
+ name: string;
25
+ };
24
26
  export type { Options as NoMathRandomCryptoOptions };
package/src/rules/no-numeric-only-tokens/index.d.ts CHANGED
@@ -18,5 +18,7 @@ export interface Options {
18
18
  allowedContexts?: string[];
19
19
  }
20
20
  type RuleOptions = [Options?];
21
- export declare const noNumericOnlyTokens: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
21
+ export declare const noNumericOnlyTokens: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
22
+ name: string;
23
+ };
22
24
  export type { Options as NoNumericOnlyTokensOptions };
package/src/rules/no-predictable-salt/index.d.ts CHANGED
@@ -17,5 +17,7 @@ export interface Options {
17
17
  minSaltLength?: number;
18
18
  }
19
19
  type RuleOptions = [Options?];
20
- export declare const noPredictableSalt: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
20
+ export declare const noPredictableSalt: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
21
+ name: string;
22
+ };
21
23
  export type { Options as NoPredictableSaltOptions };
package/src/rules/no-web-crypto-export/index.d.ts CHANGED
@@ -20,5 +20,7 @@ export interface Options {
20
20
  allowInTests?: boolean;
21
21
  }
22
22
  type RuleOptions = [Options?];
23
- export declare const noWebCryptoExport: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
23
+ export declare const noWebCryptoExport: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
24
+ name: string;
25
+ };
24
26
  export type { Options as NoWebCryptoExportOptions };
package/src/rules/require-authenticated-encryption/index.d.ts CHANGED
@@ -20,5 +20,7 @@ export interface Options {
20
20
  allowInTests?: boolean;
21
21
  }
22
22
  type RuleOptions = [Options?];
23
- export declare const requireAuthenticatedEncryption: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
23
+ export declare const requireAuthenticatedEncryption: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
24
+ name: string;
25
+ };
24
26
  export type { Options as RequireAuthenticatedEncryptionOptions };
package/src/rules/require-key-length/index.d.ts CHANGED
@@ -17,5 +17,7 @@ export interface Options {
17
17
  minKeyBits?: number;
18
18
  }
19
19
  type RuleOptions = [Options?];
20
- export declare const requireKeyLength: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
20
+ export declare const requireKeyLength: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
21
+ name: string;
22
+ };
21
23
  export type { Options as RequireKeyLengthOptions };
package/src/rules/require-random-iv/index.d.ts CHANGED
@@ -17,5 +17,7 @@ export interface Options {
17
17
  allowedSources?: string[];
18
18
  }
19
19
  type RuleOptions = [Options?];
20
- export declare const requireRandomIv: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
20
+ export declare const requireRandomIv: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
21
+ name: string;
22
+ };
21
23
  export type { Options as RequireRandomIvOptions };
package/src/rules/require-secure-pbkdf2-digest/index.d.ts CHANGED
@@ -18,5 +18,7 @@ export interface Options {
18
18
  allowedDigests?: string[];
19
19
  }
20
20
  type RuleOptions = [Options?];
21
- export declare const requireSecurePbkdf2Digest: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
21
+ export declare const requireSecurePbkdf2Digest: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
22
+ name: string;
23
+ };
22
24
  export type { Options as RequireSecurePbkdf2DigestOptions };
package/src/rules/require-sufficient-length/index.d.ts CHANGED
@@ -18,5 +18,7 @@ export interface Options {
18
18
  minLength?: number;
19
19
  }
20
20
  type RuleOptions = [Options?];
21
- export declare const requireSufficientLength: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener>;
21
+ export declare const requireSufficientLength: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
22
+ name: string;
23
+ };
22
24
  export type { Options as RequireSufficientLengthOptions };