eslint-plugin-node-security 4.0.1 โ†’ 4.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +8 -6
  2. package/README.md +64 -159
  3. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -1,7 +1,3 @@
1
- # 4.0.0 (2026-02-02)
2
-
3
- This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
4
-
5
1
  # Changelog
6
2
 
7
3
  All notable changes to `eslint-plugin-node-security` will be documented in this file.
@@ -9,13 +5,19 @@ All notable changes to `eslint-plugin-node-security` will be documented in this
9
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
10
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
11
7
 
12
- ## [Unreleased]
13
-
14
8
  ### Documentation
15
9
 
16
10
  - ๐Ÿ“˜ Launched new documentation site: [eslint.interlace.tools](https://eslint.interlace.tools/)
17
11
  - ๐Ÿ“ Achieved 100% documentation parity (both .md and .mdx files)
18
12
 
13
+ ## [4.0.1] - 2026-02-02
14
+
15
+ This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
16
+
17
+ ## [4.0.0] - 2026-02-02
18
+
19
+ This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
20
+
19
21
  ## [1.0.0] - 2026-01-26
20
22
 
21
23
  ### Added
package/README.md CHANGED
@@ -16,7 +16,8 @@
16
16
 
17
17
  ## Description
18
18
 
19
- This plugin provides comprehensive security rules for Node.js core modules, detecting command injection, path traversal, code execution vulnerabilities, and cryptographic weaknesses. It focuses on the modules most susceptible to critical vulnerabilities: `fs`, `child_process`, `vm`, `crypto`, and `Buffer`. By integrating these checks, you proactively identify and mitigate security risks in your Node.js applications.
19
+ This plugin provides Security rules for Node.js core modules (fs, child_process, crypto, etc).
20
+ By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.
20
21
 
21
22
  ## Philosophy
22
23
 
@@ -24,19 +25,18 @@ This plugin provides comprehensive security rules for Node.js core modules, dete
24
25
 
25
26
  ## Getting Started
26
27
 
27
- - To check out the [guide](https://eslint.interlace.tools/docs/node-security), visit [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
28
- - ่ฆๆŸฅ็œ‹ไธญๆ–‡ [ๆŒ‡ๅ—](https://eslint.interlace.tools/docs/node-security), ่ฏท่ฎฟ้—ฎ [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
29
- - [๊ฐ€์ด๋“œ](https://eslint.interlace.tools/docs/node-security) ๋ฌธ์„œ๋Š” [eslint.interlace.tools](https://eslint.interlace.tools)์—์„œ ํ™•์ธํ•˜์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๐Ÿ“š
30
- - [ใ‚ฌใ‚คใƒ‰](https://eslint.interlace.tools/docs/node-security)ใฏ [eslint.interlace.tools](https://eslint.interlace.tools)ใงใ”็ขบ่ชใใ ใ•ใ„ใ€‚ ๐Ÿ“š
31
- - Para ver la [guรญa](https://eslint.interlace.tools/docs/node-security), visita [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
32
- - ู„ู„ุงุทู„ุงุน ุนู„ู‰ [ุงู„ุฏู„ูŠู„](https://eslint.interlace.tools/docs/node-security)ุŒ ู‚ู… ุจุฒูŠุงุฑุฉ [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
28
+ - To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-node-security), visit [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
29
+ - ่ฆๆŸฅ็œ‹ไธญๆ–‡ [ๆŒ‡ๅ—](https://eslint.interlace.tools/docs/security/plugin-node-security), ่ฏท่ฎฟ้—ฎ [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
30
+ - [๊ฐ€์ด๋“œ](https://eslint.interlace.tools/docs/security/plugin-node-security) ๋ฌธ์„œ๋Š” [eslint.interlace.tools](https://eslint.interlace.tools)์—์„œ ํ™•์ธํ•˜์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๐Ÿ“š
31
+ - [ใ‚ฌใ‚คใƒ‰](https://eslint.interlace.tools/docs/security/plugin-node-security)ใฏ [eslint.interlace.tools](https://eslint.interlace.tools)ใงใ”็ขบ่ชใใ ใ•ใ„ใ€‚ ๐Ÿ“š
32
+ - Para ver la [guรญa](https://eslint.interlace.tools/docs/security/plugin-node-security), visita [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
33
+ - ู„ู„ุงุทู„ุงุน ุนู„ู‰ [ุงู„ุฏู„ูŠู„](https://eslint.interlace.tools/docs/security/plugin-node-security)ุŒ ู‚ู… ุจุฒูŠุงุฑุฉ [eslint.interlace.tools](https://eslint.interlace.tools). ๐Ÿ“š
33
34
 
34
35
  ```bash
35
36
  npm install eslint-plugin-node-security --save-dev
36
37
  ```
37
38
 
38
39
  ## ๐Ÿ’ก What You Get
39
-
40
40
  - **31 security rules** covering Node.js core module vulnerabilities
41
41
  - **Command Injection Detection** for `child_process.exec`, `spawn`, and `execFile`
42
42
  - **Path Traversal Prevention** for `fs` module operations
@@ -45,7 +45,6 @@ npm install eslint-plugin-node-security --save-dev
45
45
  - **LLM-optimized messages** with CWE references and fix guidance
46
46
 
47
47
  ## โš™๏ธ Configuration Presets
48
-
49
48
  | Preset | Description |
50
49
  | :------------ | :---------------------------------------------------- |
51
50
  | `recommended` | Balanced security for most Node.js projects |
@@ -55,168 +54,74 @@ npm install eslint-plugin-node-security --save-dev
55
54
 
56
55
  ---
57
56
 
58
- ## ๐Ÿข Enterprise Integration Example
59
-
60
- ```bash
61
- # Install once at the repo root
62
- npm add -D eslint-plugin-node-security
63
-
64
- # eslint.config.js (org-standard)
65
- import nodeSecurity from 'eslint-plugin-node-security';
66
-
67
- export default [
68
- // Baseline for all Node.js services
69
- nodeSecurity.configs.recommended,
70
-
71
- // Strict enforcement for security-critical services
72
- {
73
- files: ['services/auth/**', 'services/payments/**'],
74
- ...nodeSecurity.configs.strict,
75
- },
76
-
77
- // File handling services need extra fs protection
78
- {
79
- files: ['services/file-upload/**', 'services/export/**'],
80
- ...nodeSecurity.configs['fs-security'],
81
- },
82
- ];
83
- ```
84
-
85
- ---
86
-
87
- ## AI-Optimized Messages
88
-
89
- This plugin is optimized for ESLint's [Model Context Protocol (MCP)](https://eslint.org/docs/latest/use/mcp), enabling AI assistants like **Cursor**, **GitHub Copilot**, and **Claude** to:
90
-
91
- - Understand the exact vulnerability type via CWE references
92
- - Apply the correct fix using structured guidance
93
- - Provide educational context to developers
94
-
95
- ```bash
96
- src/utils/exec.ts
97
- 15:5 error ๐Ÿ”’ CWE-78 OWASP:A03-Injection CVSS:9.8 | Command Injection detected | CRITICAL [SOC2,PCI-DSS]
98
- Fix: Use execFile() with args array: execFile('ls', ['-la', dir]) | https://owasp.org/...
99
- ```
100
-
101
- ```json
102
- // .cursor/mcp.json
103
- {
104
- "mcpServers": {
105
- "eslint": {
106
- "command": "npx",
107
- "args": ["@eslint/mcp@latest"]
108
- }
109
- }
110
- }
111
- ```
112
-
113
- By providing this structured context (CWE, OWASP, Fix), we enable AI tools to **reason** about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the _exact_ correct fix immediately.
114
-
115
- ---
116
-
117
- ## ๐Ÿ”’ Privacy
118
-
119
- This plugin runs **100% locally**. No data ever leaves your machine.
120
-
121
- ---
122
-
123
57
  ## Rules
124
58
 
125
59
  **Legend**
126
60
 
127
- | Icon | Description |
128
- | :--: | :----------------------------------------------------------------- |
129
- | ๐Ÿ’ผ | **Recommended**: Included in the recommended preset. |
130
- | โš ๏ธ | **Warns**: Set to warn in recommended preset. |
131
- | ๐Ÿ”ง | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
132
- | ๐Ÿ’ก | **Suggestions**: Providing code suggestions in IDE. |
133
- | ๐Ÿšซ | **Deprecated**: This rule is deprecated. |
134
-
135
- ### Command Execution & Code Injection
136
-
137
- | Rule | CWE | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก |
138
- | :------------------------------------------------------------------------------------------------------- | :-----: | :--: | :-------------------------------------- | :-: | :-: | :-: | :-: |
139
- | [detect-child-process](https://eslint.interlace.tools/docs/node-security/rules/detect-child-process) | CWE-78 | 9.8 | Detect dangerous child_process calls | ๐Ÿ’ผ | | | ๐Ÿ’ก |
140
- | [detect-eval-with-expression](https://eslint.interlace.tools/docs/node-security/rules/detect-eval-with-expression) | CWE-95 | 9.8 | Detect eval() with dynamic expressions | ๐Ÿ’ผ | | | |
141
- | [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/node-security/rules/no-unsafe-dynamic-require) | CWE-706 | 7.5 | Prevent arbitrary module loading | ๐Ÿ’ผ | | | ๐Ÿ’ก |
142
- | [no-dynamic-require](https://eslint.interlace.tools/docs/node-security/rules/no-dynamic-require) | CWE-706 | 7.5 | Detect dynamic require() calls | | โš ๏ธ | | |
143
-
144
- ### File System Security
145
-
146
- | Rule | CWE | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก |
147
- | :------------------------------------------------------------------------------------------------------- | :-----: | :--: | :-------------------------------------- | :-: | :-: | :-: | :-: |
148
- | [detect-non-literal-fs-filename](https://eslint.interlace.tools/docs/node-security/rules/detect-non-literal-fs-filename) | CWE-22 | 7.5 | Detect user-controlled file paths | ๐Ÿ’ผ | | | ๐Ÿ’ก |
149
- | [no-arbitrary-file-access](https://eslint.interlace.tools/docs/node-security/rules/no-arbitrary-file-access) | CWE-22 | 7.5 | Prevent arbitrary file read/write | ๐Ÿ’ผ | | | |
150
- | [no-zip-slip](https://eslint.interlace.tools/docs/node-security/rules/no-zip-slip) | CWE-22 | 8.1 | Prevent Zip Slip directory traversal | ๐Ÿ’ผ | | | |
151
- | [no-toctou-vulnerability](https://eslint.interlace.tools/docs/node-security/rules/no-toctou-vulnerability) | CWE-367 | 7.0 | Detect race conditions in file ops | ๐Ÿ’ผ | | | ๐Ÿ’ก |
152
- | [no-data-in-temp-storage](https://eslint.interlace.tools/docs/node-security/rules/no-data-in-temp-storage) | CWE-312 | 7.5 | Prevent sensitive data in temp files | | โš ๏ธ | | |
153
- | [require-secure-deletion](https://eslint.interlace.tools/docs/node-security/rules/require-secure-deletion) | CWE-459 | 7.5 | Require secure file deletion | | | | |
154
- | [require-storage-encryption](https://eslint.interlace.tools/docs/node-security/rules/require-storage-encryption) | CWE-311 | 7.5 | Require encryption for stored data | | | | |
155
-
156
- ### Buffer & Memory Safety
157
-
158
- | Rule | CWE | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก |
159
- | :------------------------------------------------------------------------------------------------------- | :-----: | :--: | :-------------------------------------- | :-: | :-: | :-: | :-: |
160
- | [no-buffer-overread](https://eslint.interlace.tools/docs/node-security/rules/no-buffer-overread) | CWE-126 | 7.5 | Detect buffer access beyond bounds | ๐Ÿ’ผ | | | |
161
-
162
- ### Cryptographic Security
163
-
164
- | Rule | CWE | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก |
165
- | :------------------------------------------------------------------------------------------------------- | :-----: | :--: | :-------------------------------------- | :-: | :-: | :-: | :-: |
166
- | [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/node-security/rules/no-weak-hash-algorithm) | CWE-327 | 7.5 | Detect weak hash algorithms (MD5, SHA1) | ๐Ÿ’ผ | | | ๐Ÿ’ก |
167
- | [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/node-security/rules/no-weak-cipher-algorithm) | CWE-327 | 7.5 | Detect weak cipher algorithms (DES, RC4)| ๐Ÿ’ผ | | | ๐Ÿ’ก |
168
- | [no-deprecated-cipher-method](https://eslint.interlace.tools/docs/node-security/rules/no-deprecated-cipher-method) | CWE-327 | 5.0 | Detect deprecated cipher methods | ๐Ÿ’ผ | | | ๐Ÿ’ก |
169
- | [no-static-iv](https://eslint.interlace.tools/docs/node-security/rules/no-static-iv) | CWE-329 | 7.5 | Detect static initialization vectors | ๐Ÿ’ผ | | | ๐Ÿ’ก |
170
- | [no-ecb-mode](https://eslint.interlace.tools/docs/node-security/rules/no-ecb-mode) | CWE-327 | 7.5 | Detect insecure ECB cipher mode | ๐Ÿ’ผ | | | ๐Ÿ’ก |
171
- | [no-insecure-key-derivation](https://eslint.interlace.tools/docs/node-security/rules/no-insecure-key-derivation) | CWE-916 | 7.5 | Detect weak key derivation functions | ๐Ÿ’ผ | | | ๐Ÿ’ก |
172
- | [no-insecure-rsa-padding](https://eslint.interlace.tools/docs/node-security/rules/no-insecure-rsa-padding) | CWE-327 | 7.4 | Detect insecure RSA padding | ๐Ÿ’ผ | | | ๐Ÿ’ก |
173
- | [no-sha1-hash](https://eslint.interlace.tools/docs/node-security/rules/no-sha1-hash) | CWE-327 | 7.5 | Detect SHA1 usage in security contexts | ๐Ÿ’ผ | | | ๐Ÿ’ก |
174
- | [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/node-security/rules/no-timing-unsafe-compare) | CWE-208 | 5.9 | Detect timing-unsafe comparisons | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก |
175
- | [no-self-signed-certs](https://eslint.interlace.tools/docs/node-security/rules/no-self-signed-certs) | CWE-295 | 7.5 | Detect self-signed certificate usage | ๐Ÿ’ผ | | | ๐Ÿ’ก |
176
- | [no-cryptojs](https://eslint.interlace.tools/docs/node-security/rules/no-cryptojs) | CWE-327 | 5.0 | Discourage crypto-js in favor of native | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก |
177
- | [no-cryptojs-weak-random](https://eslint.interlace.tools/docs/node-security/rules/no-cryptojs-weak-random) | CWE-338 | 5.3 | Detect weak random from crypto-js | ๐Ÿ’ผ | | | ๐Ÿ’ก |
178
- | [prefer-native-crypto](https://eslint.interlace.tools/docs/node-security/rules/prefer-native-crypto) | CWE-327 | 5.0 | Prefer Node.js native crypto | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก |
179
- | [require-secure-credential-storage](https://eslint.interlace.tools/docs/node-security/rules/require-secure-credential-storage) | CWE-522 | 7.5 | Require secure credential storage | | | | |
180
-
181
- ### Dependency & Supply Chain Security
182
-
183
- | Rule | CWE | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก |
184
- | :------------------------------------------------------------------------------------------------------- | :-----: | :--: | :-------------------------------------- | :-: | :-: | :-: | :-: |
185
- | [detect-suspicious-dependencies](https://eslint.interlace.tools/docs/node-security/rules/detect-suspicious-dependencies) | CWE-829 | 8.2 | Detect typosquatting packages | ๐Ÿ’ผ | | | |
186
- | [no-dynamic-dependency-loading](https://eslint.interlace.tools/docs/node-security/rules/no-dynamic-dependency-loading) | CWE-829 | 7.5 | Prevent runtime dependency loading | | โš ๏ธ | | |
187
- | [require-dependency-integrity](https://eslint.interlace.tools/docs/node-security/rules/require-dependency-integrity) | CWE-494 | 7.5 | Require integrity checks for deps | | | | |
188
- | [lock-file](https://eslint.interlace.tools/docs/node-security/rules/lock-file) | CWE-829 | 7.5 | Ensure package lock file exists | ๐Ÿ’ผ | | | |
189
-
190
- ### Data Protection
191
-
192
- | Rule | CWE | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก |
193
- | :------------------------------------------------------------------------------------------------------- | :-----: | :--: | :-------------------------------------- | :-: | :-: | :-: | :-: |
194
- | [no-pii-in-logs](https://eslint.interlace.tools/docs/node-security/rules/no-pii-in-logs) | CWE-532 | 7.5 | Prevent PII in log statements | | โš ๏ธ | | |
195
-
196
- ---
61
+ | Icon | Description |
62
+ | :---: | :--- |
63
+ | ๐Ÿ’ผ | **Recommended**: Included in the recommended preset. |
64
+ | โš ๏ธ | **Warns**: Set towarn in recommended preset. |
65
+ | ๐Ÿ”ง | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
66
+ | ๐Ÿ’ก | **Suggestions**: Providing code suggestions in IDE. |
67
+ | ๐Ÿšซ | **Deprecated**: This rule is deprecated. |
68
+
69
+ | Rule | CWE | OWASP | CVSS | Description | ๐Ÿ’ผ | โš ๏ธ | ๐Ÿ”ง | ๐Ÿ’ก | ๐Ÿšซ |
70
+ | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: |
71
+ | [detect-child-process](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-child-process) | CWE-78 | | 9.8 | ESLint rule documentation for detect-child-process | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
72
+ | [detect-eval-with-expression](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-eval-with-expression) | CWE-95 | | 9.8 | ESLint rule documentation for detect-eval-with-expression | ๐Ÿ’ผ | | | | |
73
+ | [detect-non-literal-fs-filename](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-non-literal-fs-filename) | CWE-22 | | 7.5 | ESLint rule documentation for detect-non-literal-fs-filename | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
74
+ | [detect-suspicious-dependencies](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-suspicious-dependencies) | CWE-829 | | 8.2 | ESLint rule documentation for detect-suspicious-dependencies | ๐Ÿ’ผ | | | | |
75
+ | [lock-file](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/lock-file) | CWE-829 | | 7.5 | ESLint rule documentation for lock-file | ๐Ÿ’ผ | | | | |
76
+ | [no-arbitrary-file-access](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-arbitrary-file-access) | CWE-22 | | 7.5 | ESLint rule documentation for no-arbitrary-file-access | ๐Ÿ’ผ | | | | |
77
+ | [no-buffer-overread](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-buffer-overread) | CWE-126 | | 7.5 | ESLint rule documentation for no-buffer-overread | ๐Ÿ’ผ | | | | |
78
+ | [no-cryptojs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs) | CWE-327 | | 5.0 | ESLint rule documentation for no-cryptojs | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก | |
79
+ | [no-cryptojs-weak-random](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs-weak-random) | CWE-338 | | 5.3 | ESLint rule documentation for no-cryptojs-weak-random | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
80
+ | [no-data-in-temp-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-data-in-temp-storage) | CWE-312 | | 7.5 | ESLint rule documentation for no-data-in-temp-storage | | โš ๏ธ | | | |
81
+ | [no-deprecated-cipher-method](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-deprecated-cipher-method) | CWE-327 | | 5.0 | ESLint rule documentation for no-deprecated-cipher-method | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
82
+ | [no-dynamic-dependency-loading](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-dependency-loading) | CWE-829 | | 7.5 | ESLint rule documentation for no-dynamic-dependency-loading | | โš ๏ธ | | | |
83
+ | [no-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-require) | CWE-706 | | 7.5 | ESLint rule documentation for no-dynamic-require | | โš ๏ธ | | | |
84
+ | [no-ecb-mode](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ecb-mode) | CWE-327 | | 7.5 | ESLint rule documentation for no-ecb-mode | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
85
+ | [no-insecure-key-derivation](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-key-derivation) | CWE-916 | | 7.5 | ESLint rule documentation for no-insecure-key-derivation | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
86
+ | [no-insecure-rsa-padding](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-rsa-padding) | CWE-327 | | 7.4 | ESLint rule documentation for no-insecure-rsa-padding | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
87
+ | [no-pii-in-logs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-pii-in-logs) | CWE-532 | | 7.5 | ESLint rule documentation for no-pii-in-logs | | โš ๏ธ | | | |
88
+ | [no-self-signed-certs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-self-signed-certs) | CWE-295 | | 7.5 | ESLint rule documentation for no-self-signed-certs | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
89
+ | [no-sha1-hash](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-sha1-hash) | CWE-327 | | 7.5 | ESLint rule documentation for no-sha1-hash | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
90
+ | [no-static-iv](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-static-iv) | CWE-329 | | 7.5 | ESLint rule documentation for no-static-iv | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
91
+ | [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-timing-unsafe-compare) | CWE-208 | | 5.9 | ESLint rule documentation for no-timing-unsafe-compare | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก | |
92
+ | [no-toctou-vulnerability](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-toctou-vulnerability) | CWE-367 | | 7.0 | ESLint rule documentation for no-toctou-vulnerability | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
93
+ | [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-dynamic-require) | CWE-706 | | 7.5 | ESLint rule documentation for no-unsafe-dynamic-require | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
94
+ | [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-cipher-algorithm) | CWE-327 | | 7.5 | ESLint rule documentation for no-weak-cipher-algorithm | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
95
+ | [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-hash-algorithm) | CWE-327 | | 7.5 | ESLint rule documentation for no-weak-hash-algorithm | ๐Ÿ’ผ | | | ๐Ÿ’ก | |
96
+ | [no-zip-slip](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-zip-slip) | CWE-22 | | 8.1 | ESLint rule documentation for no-zip-slip | ๐Ÿ’ผ | | | | |
97
+ | [prefer-native-crypto](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/prefer-native-crypto) | CWE-327 | | 5.0 | ESLint rule documentation for prefer-native-crypto | ๐Ÿ’ผ | โš ๏ธ | | ๐Ÿ’ก | |
98
+ | [require-dependency-integrity](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-dependency-integrity) | CWE-494 | | 7.5 | ESLint rule documentation for require-dependency-integrity | | | | | |
99
+ | [require-secure-credential-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-credential-storage) | CWE-522 | | 7.5 | ESLint rule documentation for require-secure-credential-storage | | | | | |
100
+ | [require-secure-deletion](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-deletion) | CWE-459 | | 7.5 | ESLint rule documentation for require-secure-deletion | | | | | |
101
+ | [require-storage-encryption](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-storage-encryption) | CWE-311 | | 7.5 | ESLint rule documentation for require-storage-encryption | | | | | |
197
102
 
198
103
  ## ๐Ÿ”— Related ESLint Plugins
199
104
 
200
105
  Part of the **Interlace ESLint Ecosystem** โ€” AI-native security plugins with LLM-optimized error messages:
201
106
 
202
- | Plugin | Downloads | Description |
203
- | :--------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :------------------------------------------ |
204
- | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
205
- | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
206
- | [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-crypto.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
207
- | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
208
- | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
209
- | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
210
- | [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-lambda-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
211
- | [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-nestjs-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
212
- | [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-mongodb-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB security best practices. |
213
- | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
214
- | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
107
+ | Plugin | Downloads | Description |
108
+ | :--- | :---: | :--- |
109
+ | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
110
+ | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
111
+ | [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-crypto.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
112
+ | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
113
+ | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
114
+ | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
115
+ | [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-lambda-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
116
+ | [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-nestjs-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
117
+ | [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-mongodb-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB security best practices. |
118
+ | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
119
+ | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
215
120
 
216
121
  ## ๐Ÿ“„ License
217
122
 
218
123
  MIT ยฉ [Ofri Peretz](https://github.com/ofri-peretz)
219
124
 
220
125
  <p align="center">
221
- <a href="https://eslint.interlace.tools/docs/node-security"><img src="https://eslint.interlace.tools/images/og-secure-coding.png" alt="ESLint Interlace Plugin" width="300" /></a>
222
- </p>
126
+ <a href="https://eslint.interlace.tools/docs/security/plugin-node-security"><img src="https://eslint.interlace.tools/images/og-node-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
127
+ </p>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "eslint-plugin-node-security",
3
- "version": "4.0.1",
3
+ "version": "4.0.2",
4
4
  "description": "Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, path, Buffer). Detects command injection, path traversal, code execution vulnerabilities with AI-parseable error messages.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",