eslint-plugin-node-security 4.0.0

package/src/rules/no-pii-in-logs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-node-security/src/rules/no-pii-in-logs/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsG;AAUzF,QAAA,WAAW,GAAG,IAAA,0BAAU,EAA0B;IAC7D,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,wDAAwD;SACtE;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2FAA2F;gBACxG,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,SAAS,MAAM,CAAC,IAAmB;YACjC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,qCAAqC;gBACrC,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpE,CAAC;oBACD,kDAAkD;oBAClD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACjC,IACE,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;4BAC5C,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAC/C,CAAC;4BACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjD,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;4BAErE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC7C,MAAM,CAAC,IAAI,CAAC,CAAC;4BACf,CAAC;wBACH,CAAC;wBAED,uCAAuC;wBACvC,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACzE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;4BACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gCACnF,MAAM,CAAC,IAAI,CAAC,CAAC;4BACf,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-self-signed-certs/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-self-signed-certs
+ * Detects rejectUnauthorized: false in TLS options
+ * CWE-295: Improper Certificate Validation
+ *
+ * @see https://cwe.mitre.org/data/definitions/295.html
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+type MessageIds = 'insecureTls' | 'enableValidation';
+export interface Options {
+    /** Allow in test/development files. Default: false */
+    allowInTests?: boolean;
+}
+type RuleOptions = [Options?];
+export declare const noSelfSignedCerts: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export type { Options as NoSelfSignedCertsOptions };

package/src/rules/no-self-signed-certs/index.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noSelfSignedCerts = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.noSelfSignedCerts = (0, eslint_devkit_1.createRule)({
+    name: 'no-self-signed-certs',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow rejectUnauthorized: false in TLS options',
+        },
+        hasSuggestions: true,
+        messages: {
+            insecureTls: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'TLS certificate validation disabled',
+                cwe: 'CWE-295',
+                description: 'rejectUnauthorized: false disables TLS certificate validation, enabling man-in-the-middle attacks. Any certificate will be accepted, including self-signed and expired ones.',
+                severity: 'CRITICAL',
+                fix: 'Remove rejectUnauthorized: false or set it to true',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html',
+            }),
+            enableValidation: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Enable certificate validation',
+                description: 'Enable proper TLS certificate validation',
+                severity: 'LOW',
+                fix: 'rejectUnauthorized: true (or remove the property)',
+                documentationLink: 'https://nodejs.org/api/tls.html#tlsconnectoptions-callback',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow in test files',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false } = options;
+        const filename = context.filename;
+        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        function checkProperty(node) {
+            if (isTestFile)
+                return;
+            // Check for rejectUnauthorized: false
+            if (node.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                node.key.name === 'rejectUnauthorized' &&
+                node.value.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+                node.value.value === false) {
+                context.report({
+                    node,
+                    messageId: 'insecureTls',
+                    suggest: [
+                        {
+                            messageId: 'enableValidation',
+                            fix: (fixer) => {
+                                return fixer.replaceText(node.value, 'true');
+                            },
+                        },
+                    ],
+                });
+            }
+        }
+        function checkAssignmentExpression(node) {
+            if (isTestFile)
+                return;
+            // Check for process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
+            if (node.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                node.left.object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                node.left.object.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                node.left.object.object.name === 'process' &&
+                node.left.object.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                node.left.object.property.name === 'env' &&
+                node.left.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                node.left.property.name === 'NODE_TLS_REJECT_UNAUTHORIZED') {
+                if (node.right.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+                    (node.right.value === '0' || node.right.value === 0)) {
+                    /* c8 ignore next 10 -- process.env.NODE_TLS_REJECT_UNAUTHORIZED pattern requires complex AST */
+                    context.report({
+                        node,
+                        messageId: 'insecureTls',
+                        suggest: [
+                            {
+                                messageId: 'enableValidation',
+                                fix: () => null, // Should remove the assignment
+                            },
+                        ],
+                    });
+                }
+            }
+        }
+        return {
+            Property: checkProperty,
+            AssignmentExpression: checkAssignmentExpression,
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-self-signed-certs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-node-security/src/rules/no-self-signed-certs/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAazF,QAAA,iBAAiB,GAAG,IAAA,0BAAU,EAA0B;IACnE,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,mDAAmD;SACjE;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,8KAA8K;gBAC3L,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,0FAA0F;aAC9G,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,+BAA+B;gBAC1C,WAAW,EAAE,0CAA0C;gBACvD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mDAAmD;gBACxD,iBAAiB,EAAE,4DAA4D;aAChF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,qBAAqB;qBACnC;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,SAAS,aAAa,CAAC,IAAuB;YAC5C,IAAI,UAAU;gBAAE,OAAO;YAEvB,sCAAsC;YACtC,IACE,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,oBAAoB;gBACtC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,EAC1B,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,aAAa;oBACxB,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,kBAAkB;4BAC7B,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;gCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;4BAC/C,CAAC;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,SAAS,yBAAyB,CAAC,IAAmC;YACpE,IAAI,UAAU;gBAAE,OAAO;YAEvB,2DAA2D;YAC3D,IACE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;gBAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;gBACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAA8B,EAC1D,CAAC;gBACD,IACE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBAC1C,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,EACpD,CAAC;oBACD,gGAAgG;oBAChG,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,aAAa;wBACxB,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,kBAAkB;gCAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,+BAA+B;6BACjD;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,oBAAoB,EAAE,yBAAyB;SAChD,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-sha1-hash/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-sha1-hash
+ * Detects sha1() usage from crypto-hash package
+ * CWE-327: SHA-1 is cryptographically broken
+ *
+ * The crypto-hash package itself warns: "SHA-1 is insecure and should not be used"
+ * @see https://www.npmjs.com/package/crypto-hash
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+type MessageIds = 'sha1Deprecated' | 'useSha256' | 'useSha512';
+export interface Options {
+    /** Allow SHA1 in test files. Default: false */
+    allowInTests?: boolean;
+}
+type RuleOptions = [Options?];
+export declare const noSha1Hash: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export type { Options as NoSha1HashOptions };

package/src/rules/no-sha1-hash/index.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noSha1Hash = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.noSha1Hash = (0, eslint_devkit_1.createRule)({
+    name: 'no-sha1-hash',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow sha1() from crypto-hash package (use sha256 or sha512)',
+        },
+        hasSuggestions: true,
+        messages: {
+            sha1Deprecated: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'SHA-1 hash detected',
+                cwe: 'CWE-327',
+                description: 'SHA-1 is cryptographically broken and should not be used. The crypto-hash package itself warns against using sha1().',
+                severity: 'HIGH',
+                fix: 'Use sha256() or sha512() instead',
+                documentationLink: 'https://shattered.io/',
+            }),
+            useSha256: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use sha256',
+                description: 'SHA-256 provides adequate security for most use cases',
+                severity: 'LOW',
+                fix: "import { sha256 } from 'crypto-hash'; await sha256(data)",
+                documentationLink: 'https://www.npmjs.com/package/crypto-hash',
+            }),
+            useSha512: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use sha512',
+                description: 'SHA-512 provides stronger security with longer hash',
+                severity: 'LOW',
+                fix: "import { sha512 } from 'crypto-hash'; await sha512(data)",
+                documentationLink: 'https://www.npmjs.com/package/crypto-hash',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow SHA1 in test files',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false } = options;
+        const filename = context.filename;
+        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        // Track if sha1 was imported from crypto-hash
+        let sha1ImportedFromCryptoHash = false;
+        return {
+            ImportDeclaration(node) {
+                if (isTestFile)
+                    return;
+                // Check for: import { sha1 } from 'crypto-hash'
+                if (node.source.value === 'crypto-hash') {
+                    for (const specifier of node.specifiers) {
+                        if (specifier.type === eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier &&
+                            specifier.imported.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                            specifier.imported.name === 'sha1') {
+                            sha1ImportedFromCryptoHash = true;
+                            context.report({
+                                node: specifier,
+                                messageId: 'sha1Deprecated',
+                                suggest: [
+                                    {
+                                        messageId: 'useSha256',
+                                        fix: (fixer) => {
+                                            return fixer.replaceText(specifier.imported, 'sha256');
+                                        },
+                                    },
+                                    {
+                                        messageId: 'useSha512',
+                                        fix: (fixer) => {
+                                            return fixer.replaceText(specifier.imported, 'sha512');
+                                        },
+                                    },
+                                ],
+                            });
+                        }
+                    }
+                }
+            },
+            CallExpression(node) {
+                if (isTestFile)
+                    return;
+                // Check for sha1() call if imported from crypto-hash
+                if (sha1ImportedFromCryptoHash &&
+                    node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    node.callee.name === 'sha1') {
+                    /* c8 ignore next 12 -- sha1() call pattern requires specific import tracking */
+                    context.report({
+                        node,
+                        messageId: 'sha1Deprecated',
+                        suggest: [
+                            {
+                                messageId: 'useSha256',
+                                fix: (fixer) => {
+                                    return fixer.replaceText(node.callee, 'sha256');
+                                },
+                            },
+                        ],
+                    });
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-sha1-hash/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-node-security/src/rules/no-sha1-hash/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAAsG;AAczF,QAAA,UAAU,GAAG,IAAA,0BAAU,EAA0B;IAC5D,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,iEAAiE;SAC/E;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qBAAqB;gBAChC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,sHAAsH;gBACnI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0DAA0D;gBAC/D,iBAAiB,EAAE,2CAA2C;aAC/D,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,qDAAqD;gBAClE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0DAA0D;gBAC/D,iBAAiB,EAAE,2CAA2C;aAC/D,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,0BAA0B;qBACxC;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,8CAA8C;QAC9C,IAAI,0BAA0B,GAAG,KAAK,CAAC;QAEvC,OAAO;YACL,iBAAiB,CAAC,IAAgC;gBAChD,IAAI,UAAU;oBAAE,OAAO;gBAEvB,gDAAgD;gBAChD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;oBACxC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;wBACxC,IACE,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;4BACjD,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;4BACrD,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAClC,CAAC;4BACD,0BAA0B,GAAG,IAAI,CAAC;4BAClC,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,SAAS;gCACf,SAAS,EAAE,gBAAgB;gCAC3B,OAAO,EAAE;oCACP;wCACE,SAAS,EAAE,WAAW;wCACtB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;4CACjC,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;wCACzD,CAAC;qCACF;oCACD;wCACE,SAAS,EAAE,WAAW;wCACtB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;4CACjC,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;wCACzD,CAAC;qCACF;iCACF;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU;oBAAE,OAAO;gBAEvB,qDAAqD;gBACrD,IACE,0BAA0B;oBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAC3B,CAAC;oBACD,gFAAgF;oBAChF,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,gBAAgB;wBAC3B,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,WAAW;gCACtB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;oCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gCAClD,CAAC;6BACF;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-static-iv/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-static-iv
+ * Detects use of hardcoded or reused initialization vectors (IVs)
+ * CWE-329: Not Using an Unpredictable IV with CBC Mode
+ *
+ * @see https://cwe.mitre.org/data/definitions/329.html
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+type MessageIds = 'staticIv' | 'useRandomBytes';
+export interface Options {
+    /** Allow static IVs in test files. Default: false */
+    allowInTests?: boolean;
+}
+type RuleOptions = [Options?];
+export declare const noStaticIv: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export type { Options as NoStaticIvOptions };

package/src/rules/no-static-iv/index.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noStaticIv = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+/**
+ * Patterns that indicate a hardcoded IV
+ */
+const STATIC_IV_PATTERNS = [
+    /^[0-9a-f]+$/i, // Hex string
+    /^[A-Za-z0-9+/]+=*$/, // Base64
+];
+exports.noStaticIv = (0, eslint_devkit_1.createRule)({
+    name: 'no-static-iv',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow static or hardcoded initialization vectors (IVs)',
+        },
+        hasSuggestions: false,
+        messages: {
+            staticIv: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Static IV detected',
+                cwe: 'CWE-329',
+                description: 'Hardcoded IV detected. Using static IVs makes encryption deterministic, allowing attackers to detect repeated plaintexts.',
+                severity: 'HIGH',
+                fix: 'Generate IV dynamically using crypto.randomBytes(16)',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#initialization-vectors',
+            }),
+            useRandomBytes: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use randomBytes',
+                description: 'Generate IV dynamically for each encryption operation',
+                severity: 'LOW',
+                fix: 'const iv = crypto.randomBytes(16);',
+                documentationLink: 'https://nodejs.org/api/crypto.html#cryptorandombytessize-callback',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow static IVs in test files',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false } = options;
+        const filename = context.filename;
+        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        // Track variables assigned from randomBytes
+        const randomIvVariables = new Set();
+        function checkVariableDeclarator(node) {
+            // Track: const iv = crypto.randomBytes(16)
+            if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                node.init?.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
+                const init = node.init;
+                if (init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                    init.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    init.callee.property.name === 'randomBytes') {
+                    randomIvVariables.add(node.id.name);
+                }
+                /* c8 ignore next 4 -- standalone randomBytes call requires specific import pattern */
+                if (init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    init.callee.name === 'randomBytes') {
+                    randomIvVariables.add(node.id.name);
+                }
+            }
+        }
+        function checkCallExpression(node) {
+            if (isTestFile)
+                return;
+            // Check for createCipheriv calls
+            const isCipherivCall = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                (node.callee.property.name === 'createCipheriv' || node.callee.property.name === 'createDecipheriv')) ||
+                (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    (node.callee.name === 'createCipheriv' || node.callee.name === 'createDecipheriv'));
+            if (isCipherivCall && node.arguments.length >= 3) {
+                const ivArg = node.arguments[2];
+                checkIvArgument(ivArg);
+            }
+        }
+        function checkIvArgument(ivArg) {
+            // Check for string literal IV
+            if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof ivArg.value === 'string') {
+                const value = ivArg.value;
+                if (STATIC_IV_PATTERNS.some(p => p.test(value)) || value.length >= 8) {
+                    reportStaticIv(ivArg);
+                }
+            }
+            // Check for Buffer.from('static')
+            if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+                ivArg.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                ivArg.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                ivArg.callee.object.name === 'Buffer' &&
+                ivArg.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                (ivArg.callee.property.name === 'from' || ivArg.callee.property.name === 'alloc')) {
+                const firstArg = ivArg.arguments[0];
+                if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof firstArg.value === 'string') {
+                    reportStaticIv(ivArg);
+                }
+                /* c8 ignore next 7 -- ArrayExpression with all numeric literals is rare pattern */
+                // Check for new Uint8Array([...])
+                if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.ArrayExpression) {
+                    const allLiterals = firstArg.elements.every((el) => el?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof el.value === 'number');
+                    if (allLiterals) {
+                        reportStaticIv(ivArg);
+                    }
+                }
+            }
+            // Check for variable reference that's NOT from randomBytes
+            if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                // If we've tracked this variable as coming from randomBytes, it's OK
+                // Otherwise, we can't be sure - only flag if we have evidence it's static
+                // For now, we don't report variables as we can't always determine their source
+            }
+        }
+        function reportStaticIv(node) {
+            context.report({
+                node,
+                messageId: 'staticIv',
+            });
+        }
+        return {
+            VariableDeclarator: checkVariableDeclarator,
+            CallExpression: checkCallExpression,
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-static-iv/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-node-security/src/rules/no-static-iv/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAatG;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,cAAc,EAAG,aAAa;IAC9B,oBAAoB,EAAG,SAAS;CACjC,CAAC;AAEW,QAAA,UAAU,GAAG,IAAA,0BAAU,EAA0B;IAC5D,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,2DAA2D;SACzE;QACD,cAAc,EAAE,KAAK;QACrB,QAAQ,EAAE;YACR,QAAQ,EAAE,IAAA,gCAAgB,EAAC;gBACzB,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2HAA2H;gBACxI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,sDAAsD;gBAC3D,iBAAiB,EAAE,8GAA8G;aAClI,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,oCAAoC;gBACzC,iBAAiB,EAAE,mEAAmE;aACvF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,gCAAgC;qBAC9C;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,4CAA4C;QAC5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE5C,SAAS,uBAAuB,CAAC,IAAiC;YAChE,2CAA2C;YAC3C,IACE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC1C,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,8BAAc,CAAC,cAAc,EACjD,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,EAC3C,CAAC;oBACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;gBACD,sFAAsF;gBACtF,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,EAClC,CAAC;oBACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU;gBAAE,OAAO;YAEvB,iCAAiC;YACjC,MAAM,cAAc,GAClB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACvD,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;gBACvG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC;YAExF,IAAI,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAChC,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,SAAS,eAAe,CAAC,KAAsC;YAC7D,8BAA8B;YAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACrE,cAAc,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,IACE,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;gBAC5C,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACrD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;gBACrC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACxD,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,EACjF,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACpF,cAAc,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;gBACD,mFAAmF;gBACnF,kCAAkC;gBAClC,IAAI,QAAQ,EAAE,IAAI,KAAK,8BAAc,CAAC,eAAe,EAAE,CAAC;oBACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CACzC,CAAC,EAAuD,EAAW,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,CAC1I,CAAC;oBACF,IAAI,WAAW,EAAE,CAAC;wBAChB,cAAc,CAAC,KAAK,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBAC7C,qEAAqE;gBACrE,0EAA0E;gBAC1E,+EAA+E;YACjF,CAAC;QACH,CAAC;QAED,SAAS,cAAc,CAAC,IAAmB;YACzC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,kBAAkB,EAAE,uBAAuB;YAC3C,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-timing-unsafe-compare/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-timing-unsafe-compare
+ * Detects === comparison of secrets, suggest crypto.timingSafeEqual()
+ * CWE-208: Observable Timing Discrepancy
+ *
+ * @see https://cwe.mitre.org/data/definitions/208.html
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+type MessageIds = 'timingUnsafeCompare' | 'useTimingSafeEqual';
+export interface Options {
+    /** Variable name patterns that indicate secrets. Default: ['token', 'secret', 'key', 'password', 'hash', 'signature', 'mac', 'hmac', 'digest', 'apiKey', 'api_key'] */
+    secretPatterns?: string[];
+}
+type RuleOptions = [Options?];
+export declare const noTimingUnsafeCompare: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export type { Options as NoTimingUnsafeCompareOptions };

package/src/rules/no-timing-unsafe-compare/index.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noTimingUnsafeCompare = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const DEFAULT_SECRET_PATTERNS = [
+    // Common secret names (camelCase, snake_case, kebab-case)
+    'token', 'secret', 'key', 'password', 'hash', 'signature',
+    'mac', 'hmac', 'digest', 'apiKey', 'api_key', 'api-key',
+    'auth', 'credential', 'bearer', 'jwt', 'csrf', 'nonce',
+    // PII and sensitive data patterns
+    'ssn', 'social_security', 'social-security',
+    'pii', 'private_key', 'private-key', 'privateKey',
+    'access_token', 'access-token', 'accessToken',
+    'refresh_token', 'refresh-token', 'refreshToken',
+    'session_id', 'session-id', 'sessionId',
+    'auth_token', 'auth-token', 'authToken',
+    'encryption_key', 'encryption-key', 'encryptionKey',
+];
+exports.noTimingUnsafeCompare = (0, eslint_devkit_1.createRule)({
+    name: 'no-timing-unsafe-compare',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow timing-unsafe comparison of secrets',
+        },
+        hasSuggestions: true,
+        messages: {
+            timingUnsafeCompare: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Timing-unsafe comparison',
+                cwe: 'CWE-208',
+                description: 'Using === to compare secrets enables timing attacks. The comparison short-circuits on first mismatch, leaking information about the secret.',
+                severity: 'HIGH',
+                fix: 'Use crypto.timingSafeEqual() for constant-time comparison',
+                documentationLink: 'https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b',
+            }),
+            useTimingSafeEqual: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use timingSafeEqual',
+                description: 'Use constant-time comparison to prevent timing attacks',
+                severity: 'LOW',
+                fix: 'crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b))',
+                documentationLink: 'https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    secretPatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: DEFAULT_SECRET_PATTERNS,
+                        description: 'Variable name patterns that indicate secrets',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            secretPatterns: DEFAULT_SECRET_PATTERNS,
+        },
+    ],
+    create(context, [options = {}]) {
+        const { secretPatterns = DEFAULT_SECRET_PATTERNS } = options;
+        const patterns = secretPatterns.map(p => new RegExp(p, 'i'));
+        function isSecretIdentifier(node) {
+            if (node.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                return patterns.some(p => p.test(node.name));
+            }
+            if (node.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
+                const prop = node.property;
+                if (prop.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                    return patterns.some(p => p.test(prop.name));
+                }
+            }
+            return false;
+        }
+        function checkBinaryExpression(node) {
+            // Check for === or == comparisons
+            if (node.operator !== '===' && node.operator !== '==' &&
+                node.operator !== '!==' && node.operator !== '!=') {
+                return;
+            }
+            // Check if either side looks like a secret
+            const leftIsSecret = isSecretIdentifier(node.left);
+            const rightIsSecret = isSecretIdentifier(node.right);
+            if (leftIsSecret || rightIsSecret) {
+                /* c8 ignore next 11 -- suggestions with fix: () => null cannot be tested with RuleTester */
+                context.report({
+                    node,
+                    messageId: 'timingUnsafeCompare',
+                    suggest: [
+                        {
+                            messageId: 'useTimingSafeEqual',
+                            fix: () => null, // Complex refactoring
+                        },
+                    ],
+                });
+            }
+        }
+        return {
+            BinaryExpression: checkBinaryExpression,
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-timing-unsafe-compare/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-node-security/src/rules/no-timing-unsafe-compare/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAatG,MAAM,uBAAuB,GAAG;IAC9B,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW;IACzD,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;IACvD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IACtD,kCAAkC;IAClC,KAAK,EAAE,iBAAiB,EAAE,iBAAiB;IAC3C,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;IACjD,cAAc,EAAE,cAAc,EAAE,aAAa;IAC7C,eAAe,EAAE,eAAe,EAAE,cAAc;IAChD,YAAY,EAAE,YAAY,EAAE,WAAW;IACvC,YAAY,EAAE,YAAY,EAAE,WAAW;IACvC,gBAAgB,EAAE,gBAAgB,EAAE,eAAe;CACpD,CAAC;AAEW,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,8CAA8C;SAC5D;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,6IAA6I;gBAC1J,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,2DAA2D;gBAChE,iBAAiB,EAAE,6DAA6D;aACjF,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,WAAW,EAAE,wDAAwD;gBACrE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,wDAAwD;gBAC7D,iBAAiB,EAAE,6DAA6D;aACjF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,uBAAuB;wBAChC,WAAW,EAAE,8CAA8C;qBAC5D;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,cAAc,EAAE,uBAAuB;SACxC;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,cAAc,GAAG,uBAAuB,EAAE,GAAG,OAAkB,CAAC;QACxE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAE7D,SAAS,kBAAkB,CAAC,IAAmB;YAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,SAAS,qBAAqB,CAAC,IAA+B;YAC5D,kCAAkC;YAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;gBACjD,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAErD,IAAI,YAAY,IAAI,aAAa,EAAE,CAAC;gBAClC,4FAA4F;gBAC5F,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,qBAAqB;oBAChC,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,oBAAoB;4BAC/B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,sBAAsB;yBACxC;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,gBAAgB,EAAE,qBAAqB;SACxC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}