eslint-plugin-node-security 4.0.0 โ†’ 4.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +8 -2
  2. package/README.md +111 -34
  3. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -5,13 +5,19 @@ All notable changes to `eslint-plugin-node-security` will be documented in this
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
- ## [Unreleased]
9
-
10
8
  ### Documentation
11
9
 
12
10
  - ๐Ÿ“˜ Launched new documentation site: [eslint.interlace.tools](https://eslint.interlace.tools/)
13
11
  - ๐Ÿ“ Achieved 100% documentation parity (both .md and .mdx files)
14
12
 
13
+ ## [4.0.1] - 2026-02-02
14
+
15
+ This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
16
+
17
+ ## [4.0.0] - 2026-02-02
18
+
19
+ This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
20
+
15
21
  ## [1.0.0] - 2026-01-26
16
22
 
17
23
  ### Added
package/README.md CHANGED
@@ -1,50 +1,127 @@
1
- # eslint-plugin-node-security
1
+ <p align="center">
2
+ <a href="https://eslint.interlace.tools" target="blank"><img src="https://eslint.interlace.tools/eslint-interlace-logo-light.svg" alt="ESLint Interlace Logo" width="120" /></a>
3
+ </p>
2
4
 
3
- Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, path, Buffer). Detects command injection, path traversal, code execution vulnerabilities with AI-parseable error messages.
5
+ <p align="center">
6
+ Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, crypto, Buffer).
7
+ </p>
4
8
 
5
- Part of the [Interlace ESLint Ecosystem](https://github.com/ofri-peretz/eslint).
9
+ <p align="center">
10
+ <a href="https://www.npmjs.com/package/eslint-plugin-node-security" target="_blank"><img src="https://img.shields.io/npm/v/eslint-plugin-node-security.svg" alt="NPM Version" /></a>
11
+ <a href="https://www.npmjs.com/package/eslint-plugin-node-security" target="_blank"><img src="https://img.shields.io/npm/dm/eslint-plugin-node-security.svg" alt="NPM Downloads" /></a>
12
+ <a href="https://opensource.org/licenses/MIT" target="_blank"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="Package License" /></a>
13
+ <a href="https://app.codecov.io/gh/ofri-peretz/eslint/components?components%5B0%5D=node-security" target="_blank"><img src="https://codecov.io/gh/ofri-peretz/eslint/graph/badge.svg?component=node-security" alt="Codecov" /></a>
14
+ <a href="https://github.com/ofri-peretz/eslint" target="_blank"><img src="https://img.shields.io/badge/Since-Dec_2025-blue?logo=rocket&logoColor=white" alt="Since Dec 2025" /></a>
15
+ </p>
6
16
 
7
- ## Features
17
+ ## Description
8
18
 
9
- - **LLM-Optimized**: Error messages are designed to be easily parsed and resolved by AI assistants (Cursor, GitHub Copilot, etc.).
10
- - **OWASP Coverage**: Implements rules for OWASP Top 10 and OWASP Mobile Top 10.
11
- - **Node.js Core Security**: Specific focus on built-in modules which are most susceptible to critical vulnerabilities.
12
- - **Strict Interface**: Verified with high-fidelity unit tests.
19
+ This plugin provides Security rules for Node.js core modules (fs, child_process, crypto, etc).
20
+ By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.
13
21
 
14
- ## Installation
22
+ ## Philosophy
23
+
24
+ **Interlace** fosters **strength through integration**. Instead of stacking isolated rules, we **interlace** security directly into your workflow to create a resilient fabric of code. We believe tools should **guide rather than gatekeep**, providing educational feedback that strengthens the developer with every interaction.
25
+
26
+ ## Getting Started
27
+
28
+ - To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-node-security), visit [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
29
+ - ่ฆๆŸฅ็œ‹ไธญๆ–‡ [ๆŒ‡ๅ—](https://eslint.interlace.tools/docs/security/plugin-node-security), ่ฏท่ฎฟ้—ฎ [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
30
+ - [๊ฐ€์ด๋“œ](https://eslint.interlace.tools/docs/security/plugin-node-security) ๋ฌธ์„œ๋Š” [eslint.interlace.tools](https://eslint.interlace.tools)์—์„œ ํ™•์ธํ•˜์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๐Ÿ“š
31
+ - [ใ‚ฌใ‚คใƒ‰](https://eslint.interlace.tools/docs/security/plugin-node-security)ใฏ [eslint.interlace.tools](https://eslint.interlace.tools)ใงใ”็ขบ่ชใใ ใ•ใ„ใ€‚ ๐Ÿ“š
32
+ - Para ver la [guรญa](https://eslint.interlace.tools/docs/security/plugin-node-security), visita [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
33
+ - ู„ู„ุงุทู„ุงุน ุนู„ู‰ [ุงู„ุฏู„ูŠู„](https://eslint.interlace.tools/docs/security/plugin-node-security)ุŒ ู‚ู… ุจุฒูŠุงุฑุฉ [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
15
34
 
16
35
  ```bash
17
- npm add -D eslint-plugin-node-security
36
+ npm install eslint-plugin-node-security --save-dev
18
37
  ```
19
38
 
20
- ## Usage (Flat Config)
39
+ ## ๐Ÿ’ก What You Get
40
+ - **31 security rules** covering Node.js core module vulnerabilities
41
+ - **Command Injection Detection** for `child_process.exec`, `spawn`, and `execFile`
42
+ - **Path Traversal Prevention** for `fs` module operations
43
+ - **TOCTOU Race Condition Detection** for file system operations
44
+ - **Cryptographic Security** for weak algorithms and key management
45
+ - **LLM-optimized messages** with CWE references and fix guidance
21
46
 
22
- ```javascript
23
- import nodeSecurity from 'eslint-plugin-node-security';
47
+ ## โš™๏ธ Configuration Presets
48
+ | Preset | Description |
49
+ | :------------ | :---------------------------------------------------- |
50
+ | `recommended` | Balanced security for most Node.js projects |
51
+ | `strict` | Maximum security enforcement (all rules as errors) |
52
+ | `fs-security` | Focus on file system vulnerabilities (CWE-22, CWE-73) |
53
+ | `crypto` | Cryptographic security rules only |
24
54
 
25
- export default [
26
- nodeSecurity.configs.recommended,
27
- {
28
- rules: {
29
- 'node-security/detect-child-process': 'error',
30
- },
31
- },
32
- ];
33
- ```
55
+ ---
34
56
 
35
57
  ## Rules
36
58
 
37
- | Rule | Description | CWE |
38
- | :--------------------------------------------------------------------------------- | :----------------------------------------- | :------ |
39
- | [`detect-child-process`](./docs/rules/detect-child-process.md) | Detects dangerous child_process.exec calls | CWE-78 |
40
- | [`detect-eval-with-expression`](./docs/rules/detect-eval-with-expression.md) | Detects eval() with dynamic expressions | CWE-95 |
41
- | [`detect-non-literal-fs-filename`](./docs/rules/detect-non-literal-fs-filename.md) | Detects user-controlled file paths | CWE-22 |
42
- | [`no-unsafe-dynamic-require`](./docs/rules/no-unsafe-dynamic-require.md) | Prevents arbitrary module loading | CWE-706 |
43
- | [`no-buffer-overread`](./docs/rules/no-buffer-overread.md) | Detects buffer access beyond bounds | CWE-126 |
44
- | [`no-toctou-vulnerability`](./docs/rules/no-toctou-vulnerability.md) | Detects Race Conditions in file ops | CWE-367 |
45
- | [`no-zip-slip`](./docs/rules/no-zip-slip.md) | Prevents Zip Slip directory traversal | CWE-22 |
46
- | [`no-arbitrary-file-access`](./docs/rules/no-arbitrary-file-access.md) | Prevents arbitrary file read/write | CWE-22 |
59
+ **Legend**
60
+
61
+ | Icon | Description |
62
+ | :---: | :--- |
63
+ | ๐Ÿ’ผ | **Recommended**: Included in the recommended preset. |
64
+ | โš ๏ธ | **Warns**: Set towarn in recommended preset. |
65
+ | ๐Ÿ”ง | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
66
+ | ๐Ÿ’ก | **Suggestions**: Providing code suggestions in IDE. |
67
+ | ๐Ÿšซ | **Deprecated**: This rule is deprecated. |
68
+
69
+ | Rule | CWE | OWASP | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก | ๐Ÿšซ |
70
+ | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: |
71
+ | [detect-child-process](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-child-process) | CWE-78 | | 9.8 | ESLint rule documentation for detect-child-process | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
72
+ | [detect-eval-with-expression](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-eval-with-expression) | CWE-95 | | 9.8 | ESLint rule documentation for detect-eval-with-expression | ๐Ÿ’ผ | | | | |
73
+ | [detect-non-literal-fs-filename](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-non-literal-fs-filename) | CWE-22 | | 7.5 | ESLint rule documentation for detect-non-literal-fs-filename | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
74
+ | [detect-suspicious-dependencies](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-suspicious-dependencies) | CWE-829 | | 8.2 | ESLint rule documentation for detect-suspicious-dependencies | ๐Ÿ’ผ | | | | |
75
+ | [lock-file](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/lock-file) | CWE-829 | | 7.5 | ESLint rule documentation for lock-file | ๐Ÿ’ผ | | | | |
76
+ | [no-arbitrary-file-access](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-arbitrary-file-access) | CWE-22 | | 7.5 | ESLint rule documentation for no-arbitrary-file-access | ๐Ÿ’ผ | | | | |
77
+ | [no-buffer-overread](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-buffer-overread) | CWE-126 | | 7.5 | ESLint rule documentation for no-buffer-overread | ๐Ÿ’ผ | | | | |
78
+ | [no-cryptojs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs) | CWE-327 | | 5.0 | ESLint rule documentation for no-cryptojs | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก | |
79
+ | [no-cryptojs-weak-random](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs-weak-random) | CWE-338 | | 5.3 | ESLint rule documentation for no-cryptojs-weak-random | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
80
+ | [no-data-in-temp-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-data-in-temp-storage) | CWE-312 | | 7.5 | ESLint rule documentation for no-data-in-temp-storage | | โš ๏ธ | | | |
81
+ | [no-deprecated-cipher-method](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-deprecated-cipher-method) | CWE-327 | | 5.0 | ESLint rule documentation for no-deprecated-cipher-method | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
82
+ | [no-dynamic-dependency-loading](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-dependency-loading) | CWE-829 | | 7.5 | ESLint rule documentation for no-dynamic-dependency-loading | | โš ๏ธ | | | |
83
+ | [no-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-require) | CWE-706 | | 7.5 | ESLint rule documentation for no-dynamic-require | | โš ๏ธ | | | |
84
+ | [no-ecb-mode](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ecb-mode) | CWE-327 | | 7.5 | ESLint rule documentation for no-ecb-mode | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
85
+ | [no-insecure-key-derivation](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-key-derivation) | CWE-916 | | 7.5 | ESLint rule documentation for no-insecure-key-derivation | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
86
+ | [no-insecure-rsa-padding](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-rsa-padding) | CWE-327 | | 7.4 | ESLint rule documentation for no-insecure-rsa-padding | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
87
+ | [no-pii-in-logs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-pii-in-logs) | CWE-532 | | 7.5 | ESLint rule documentation for no-pii-in-logs | | โš ๏ธ | | | |
88
+ | [no-self-signed-certs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-self-signed-certs) | CWE-295 | | 7.5 | ESLint rule documentation for no-self-signed-certs | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
89
+ | [no-sha1-hash](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-sha1-hash) | CWE-327 | | 7.5 | ESLint rule documentation for no-sha1-hash | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
90
+ | [no-static-iv](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-static-iv) | CWE-329 | | 7.5 | ESLint rule documentation for no-static-iv | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
91
+ | [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-timing-unsafe-compare) | CWE-208 | | 5.9 | ESLint rule documentation for no-timing-unsafe-compare | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก | |
92
+ | [no-toctou-vulnerability](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-toctou-vulnerability) | CWE-367 | | 7.0 | ESLint rule documentation for no-toctou-vulnerability | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
93
+ | [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-dynamic-require) | CWE-706 | | 7.5 | ESLint rule documentation for no-unsafe-dynamic-require | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
94
+ | [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-cipher-algorithm) | CWE-327 | | 7.5 | ESLint rule documentation for no-weak-cipher-algorithm | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
95
+ | [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-hash-algorithm) | CWE-327 | | 7.5 | ESLint rule documentation for no-weak-hash-algorithm | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
96
+ | [no-zip-slip](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-zip-slip) | CWE-22 | | 8.1 | ESLint rule documentation for no-zip-slip | ๐Ÿ’ผ | | | | |
97
+ | [prefer-native-crypto](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/prefer-native-crypto) | CWE-327 | | 5.0 | ESLint rule documentation for prefer-native-crypto | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก | |
98
+ | [require-dependency-integrity](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-dependency-integrity) | CWE-494 | | 7.5 | ESLint rule documentation for require-dependency-integrity | | | | | |
99
+ | [require-secure-credential-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-credential-storage) | CWE-522 | | 7.5 | ESLint rule documentation for require-secure-credential-storage | | | | | |
100
+ | [require-secure-deletion](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-deletion) | CWE-459 | | 7.5 | ESLint rule documentation for require-secure-deletion | | | | | |
101
+ | [require-storage-encryption](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-storage-encryption) | CWE-311 | | 7.5 | ESLint rule documentation for require-storage-encryption | | | | | |
102
+
103
+ ## ๐Ÿ”— Related ESLint Plugins
104
+
105
+ Part of the **Interlace ESLint Ecosystem** โ€” AI-native security plugins with LLM-optimized error messages:
106
+
107
+ | Plugin | Downloads | Description |
108
+ | :--- | :---: | :--- |
109
+ | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
110
+ | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
111
+ | [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-crypto.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
112
+ | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
113
+ | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
114
+ | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
115
+ | [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-lambda-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
116
+ | [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-nestjs-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
117
+ | [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-mongodb-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB security best practices. |
118
+ | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
119
+ | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
120
+
121
+ ## ๐Ÿ“„ License
47
122
 
48
- ## License
123
+ MIT ยฉ [Ofri Peretz](https://github.com/ofri-peretz)
49
124
 
50
- MIT ยฉ [Ofri Peretz](https://ofriperetz.dev)
125
+ <p align="center">
126
+ <a href="https://eslint.interlace.tools/docs/security/plugin-node-security"><img src="https://eslint.interlace.tools/images/og-node-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
127
+ </p>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "eslint-plugin-node-security",
3
- "version": "4.0.0",
3
+ "version": "4.0.2",
4
4
  "description": "Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, path, Buffer). Detects command injection, path traversal, code execution vulnerabilities with AI-parseable error messages.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",