eslint-plugin-node-security 4.0.4 → 4.2.0

package/CHANGELOG.md

@@ -1,3 +1,30 @@
+## [4.1.0] - 2026-05-03
+
+### Added
+
+- New rule `no-deprecated-buffer` — flags use of the deprecated `Buffer()` constructor (Node.js security advisory; `Buffer.from`/`Buffer.alloc` should be used instead). Enabled in the `recommended` preset at `warn` to avoid breaking adopters with legacy `Buffer()` calls; will be promoted to `error` in the next major.
+
+### Bug Fixes
+
+- `no-zip-slip`: removed redundant dangerous-destination check from the literal handler. Extraction-call handler already reports `dangerousArchiveDestination`; the literal-side check was producing duplicate errors and (separately) firing on unrelated calls like `fs.readFileSync('/etc/app/config')`.
+- `lock-file`, `detect-child-process`: minor refinements (see source diff).
+
+## [4.0.4] - 2026-02-08
+
+### Bug Fixes
+
+- align codecov component IDs with full package names ([2831b968](https://github.com/ofri-peretz/eslint/commit/2831b968))
+- resolve all benchmark FN/FP across security rules ([45ffb791](https://github.com/ofri-peretz/eslint/commit/45ffb791))
+- **rules:** reduce false positives across security rules ([c192233c](https://github.com/ofri-peretz/eslint/commit/c192233c))
+
+### Documentation
+
+- fix changelog header format across all packages ([c3a15082](https://github.com/ofri-peretz/eslint/commit/c3a15082))
+
+### ❤️ Thank You
+
+- Ofri Peretz
+
 ## [4.0.3] - 2026-02-06
 
 ### Bug Fixes

package/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2025 Ofri Peretz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <a href="https://eslint.interlace.tools" target="blank"><img src="https://eslint.interlace.tools/eslint-interlace-logo-light.svg" alt="ESLint Interlace Logo" width="120" /></a>
+  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security" target="blank"><img src="https://eslint.interlace.tools/eslint-interlace-logo-light.svg" alt="ESLint Interlace Logo" width="120" /></a>
 </p>
 
 <p align="center">
@@ -10,14 +10,13 @@
   <a href="https://www.npmjs.com/package/eslint-plugin-node-security" target="_blank"><img src="https://img.shields.io/npm/v/eslint-plugin-node-security.svg" alt="NPM Version" /></a>
   <a href="https://www.npmjs.com/package/eslint-plugin-node-security" target="_blank"><img src="https://img.shields.io/npm/dm/eslint-plugin-node-security.svg" alt="NPM Downloads" /></a>
   <a href="https://opensource.org/licenses/MIT" target="_blank"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="Package License" /></a>
-  <a href="https://app.codecov.io/gh/ofri-peretz/eslint/components?components%5B0%5D=node-security" target="_blank"><img src="https://codecov.io/gh/ofri-peretz/eslint/graph/badge.svg?component=eslint-plugin-node-security" alt="Codecov" /></a>
+  <a href="https://app.codecov.io/gh/ofri-peretz/eslint/components?components%5B0%5D=node-security" target="_blank"><img src="https://codecov.io/gh/ofri-peretz/eslint/graph/badge.svg?component=node-security" alt="Codecov" /></a>
   <a href="https://github.com/ofri-peretz/eslint" target="_blank"><img src="https://img.shields.io/badge/Since-Dec_2025-blue?logo=rocket&logoColor=white" alt="Since Dec 2025" /></a>
 </p>
 
 ## Description
 
 This plugin provides Security rules for Node.js core modules (fs, child_process, crypto, etc).
-By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.
 
 ## Philosophy
 
@@ -25,17 +24,25 @@ By using this plugin, you can proactively identify and mitigate security risks a
 
 ## Getting Started
 
-- To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-node-security), visit [eslint.interlace.tools](https://eslint.interlace.tools). 📚
-- 要查看中文 [指南](https://eslint.interlace.tools/docs/security/plugin-node-security), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools). 📚
-- [가이드](https://eslint.interlace.tools/docs/security/plugin-node-security) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools)에서 확인하실 수 있습니다. 📚
-- [ガイド](https://eslint.interlace.tools/docs/security/plugin-node-security)は [eslint.interlace.tools](https://eslint.interlace.tools)でご確認ください。 📚
-- Para ver la [guía](https://eslint.interlace.tools/docs/security/plugin-node-security), visita [eslint.interlace.tools](https://eslint.interlace.tools). 📚
-- للاطلاع على [الدليل](https://eslint.interlace.tools/docs/security/plugin-node-security)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools). 📚
+- To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security). 📚
+- 要查看中文 [指南](https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security). 📚
+- [가이드](https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security)에서 확인하실 수 있습니다. 📚
+- [ガイド](https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security)は [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security)でご確認ください。 📚
+- Para ver la [guía](https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security), visita [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security). 📚
+- للاطلاع على [الدليل](https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security). 📚
 
 ```bash
 npm install eslint-plugin-node-security --save-dev
 ```
 
+## ⚙️ Configuration Presets
+| Preset        | Description                                           |
+| :------------ | :---------------------------------------------------- |
+| `recommended` | Balanced security for most Node.js projects           |
+| `strict`      | Maximum security enforcement (all rules as errors)    |
+| `fs-security` | Focus on file system vulnerabilities (CWE-22, CWE-73) |
+| `crypto`      | Cryptographic security rules only                     |
+
 ## 💡 What You Get
 - **31 security rules** covering Node.js core module vulnerabilities
 - **Command Injection Detection** for `child_process.exec`, `spawn`, and `execFile`
@@ -44,15 +51,13 @@ npm install eslint-plugin-node-security --save-dev
 - **Cryptographic Security** for weak algorithms and key management
 - **LLM-optimized messages** with CWE references and fix guidance
 
-## ⚙️ Configuration Presets
-| Preset        | Description                                           |
-| :------------ | :---------------------------------------------------- |
-| `recommended` | Balanced security for most Node.js projects           |
-| `strict`      | Maximum security enforcement (all rules as errors)    |
-| `fs-security` | Focus on file system vulnerabilities (CWE-22, CWE-73) |
-| `crypto`      | Cryptographic security rules only                     |
+## 📦 Compatibility
+| Package | Version |
+| :--- | :--- |
+| ESLint | `^8.0.0 \|\| ^9.0.0 \|\| ^10.0.0` |
+| Node.js | `>=18.0.0` |
 
----
+See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md) — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.
 
 ## Rules
 
@@ -61,45 +66,52 @@ npm install eslint-plugin-node-security --save-dev
 | Icon | Description |
 | :---: | :--- |
 | 💼 | **Recommended**: Included in the recommended preset. |
-| ⚠️ | **Warns**: Set towarn in recommended preset. |
+| ⚠️ | **Warns**: Set to warn in recommended preset. |
 | 🔧 | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
 | 💡 | **Suggestions**: Providing code suggestions in IDE. |
 | 🚫 | **Deprecated**: This rule is deprecated. |
-
-| Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
-| :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: |
-| [detect-child-process](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-child-process) | CWE-78 |  | 9.8 | ESLint rule documentation for detect-child-process | 💼 |  |  | 💡 |  |
-| [detect-eval-with-expression](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-eval-with-expression) | CWE-95 |  | 9.8 | ESLint rule documentation for detect-eval-with-expression | 💼 |  |  |  |  |
-| [detect-non-literal-fs-filename](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-non-literal-fs-filename) | CWE-22 |  | 7.5 | ESLint rule documentation for detect-non-literal-fs-filename | 💼 |  |  | 💡 |  |
-| [detect-suspicious-dependencies](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-suspicious-dependencies) | CWE-829 |  | 8.2 | ESLint rule documentation for detect-suspicious-dependencies | 💼 |  |  |  |  |
-| [lock-file](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/lock-file) | CWE-829 |  | 7.5 | ESLint rule documentation for lock-file | 💼 |  |  |  |  |
-| [no-arbitrary-file-access](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-arbitrary-file-access) | CWE-22 |  | 7.5 | ESLint rule documentation for no-arbitrary-file-access | 💼 |  |  |  |  |
-| [no-buffer-overread](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-buffer-overread) | CWE-126 |  | 7.5 | ESLint rule documentation for no-buffer-overread | 💼 |  |  |  |  |
-| [no-cryptojs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs) | CWE-327 |  | 5.0 | ESLint rule documentation for no-cryptojs | 💼 | ⚠️ |  | 💡 |  |
-| [no-cryptojs-weak-random](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs-weak-random) | CWE-338 |  | 5.3 | ESLint rule documentation for no-cryptojs-weak-random | 💼 |  |  | 💡 |  |
-| [no-data-in-temp-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-data-in-temp-storage) | CWE-312 |  | 7.5 | ESLint rule documentation for no-data-in-temp-storage |  | ⚠️ |  |  |  |
-| [no-deprecated-cipher-method](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-deprecated-cipher-method) | CWE-327 |  | 5.0 | ESLint rule documentation for no-deprecated-cipher-method | 💼 |  |  | 💡 |  |
-| [no-dynamic-dependency-loading](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-dependency-loading) | CWE-829 |  | 7.5 | ESLint rule documentation for no-dynamic-dependency-loading |  | ⚠️ |  |  |  |
-| [no-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-require) | CWE-706 |  | 7.5 | ESLint rule documentation for no-dynamic-require |  | ⚠️ |  |  |  |
-| [no-ecb-mode](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ecb-mode) | CWE-327 |  | 7.5 | ESLint rule documentation for no-ecb-mode | 💼 |  |  | 💡 |  |
-| [no-insecure-key-derivation](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-key-derivation) | CWE-916 |  | 7.5 | ESLint rule documentation for no-insecure-key-derivation | 💼 |  |  | 💡 |  |
-| [no-insecure-rsa-padding](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-rsa-padding) | CWE-327 |  | 7.4 | ESLint rule documentation for no-insecure-rsa-padding | 💼 |  |  | 💡 |  |
-| [no-pii-in-logs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-pii-in-logs) | CWE-532 |  | 7.5 | ESLint rule documentation for no-pii-in-logs |  | ⚠️ |  |  |  |
-| [no-self-signed-certs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-self-signed-certs) | CWE-295 |  | 7.5 | ESLint rule documentation for no-self-signed-certs | 💼 |  |  | 💡 |  |
-| [no-sha1-hash](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-sha1-hash) | CWE-327 |  | 7.5 | ESLint rule documentation for no-sha1-hash | 💼 |  |  | 💡 |  |
-| [no-static-iv](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-static-iv) | CWE-329 |  | 7.5 | ESLint rule documentation for no-static-iv | 💼 |  |  | 💡 |  |
-| [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-timing-unsafe-compare) | CWE-208 |  | 5.9 | ESLint rule documentation for no-timing-unsafe-compare | 💼 | ⚠️ |  | 💡 |  |
-| [no-toctou-vulnerability](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-toctou-vulnerability) | CWE-367 |  | 7.0 | ESLint rule documentation for no-toctou-vulnerability | 💼 |  |  | 💡 |  |
-| [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-dynamic-require) | CWE-706 |  | 7.5 | ESLint rule documentation for no-unsafe-dynamic-require | 💼 |  |  | 💡 |  |
-| [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-cipher-algorithm) | CWE-327 |  | 7.5 | ESLint rule documentation for no-weak-cipher-algorithm | 💼 |  |  | 💡 |  |
-| [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-hash-algorithm) | CWE-327 |  | 7.5 | ESLint rule documentation for no-weak-hash-algorithm | 💼 |  |  | 💡 |  |
-| [no-zip-slip](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-zip-slip) | CWE-22 |  | 8.1 | ESLint rule documentation for no-zip-slip | 💼 |  |  |  |  |
-| [prefer-native-crypto](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/prefer-native-crypto) | CWE-327 |  | 5.0 | ESLint rule documentation for prefer-native-crypto | 💼 | ⚠️ |  | 💡 |  |
-| [require-dependency-integrity](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-dependency-integrity) | CWE-494 |  | 7.5 | ESLint rule documentation for require-dependency-integrity |  |  |  |  |  |
-| [require-secure-credential-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-credential-storage) | CWE-522 |  | 7.5 | ESLint rule documentation for require-secure-credential-storage |  |  |  |  |  |
-| [require-secure-deletion](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-deletion) | CWE-459 |  | 7.5 | ESLint rule documentation for require-secure-deletion |  |  |  |  |  |
-| [require-storage-encryption](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-storage-encryption) | CWE-311 |  | 7.5 | ESLint rule documentation for require-storage-encryption |  |  |  |  |  |
-
+| 🟢 | **Type-unaware**: AST-only, runs in oxlint JS-plugin tier. |
+| 🟡 | **Type-aware (refining)**: pure-AST primary path; types refine precision. |
+| 🟠 | **Type-aware (graceful)**: requires TS program; silent without it. |
+
+<!-- AUTO-GENERATED:RULES_TABLE:START - Do not edit manually -->
+| Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
+| :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: |
+| [detect-child-process](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-child-process?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-78 |  |  | Detects instances of childprocess & non-literal exec() calls that may allow command injection | 🟢 |  |  |  |  |  |
+| [detect-eval-with-expression](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-eval-with-expression?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-95 | A03:2021 |  | Detects eval(variable) which can allow an attacker to run arbitrary code inside your process | 🟢 |  |  |  |  |  |
+| [detect-non-literal-fs-filename](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-non-literal-fs-filename?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-22 |  |  | Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your… | 🟢 |  |  |  |  |  |
+| [detect-suspicious-dependencies](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/detect-suspicious-dependencies?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-506 |  |  | This rule detects package imports that look like typosquatting attempts on popular npm packages | 🟢 |  |  |  |  |  |
+| [lock-file](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/lock-file?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-829 |  |  | CWE: [CWE-829](https://cwe.mitre.org/data/definitions/829.html) | 🟢 |  |  |  |  |  |
+| [no-arbitrary-file-access](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-arbitrary-file-access?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-22 | A01:2021 |  | Prevents file system access with unsanitized user input to protect against path traversal attacks. | 🟢 |  |  |  |  |  |
+| [no-buffer-overread](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-buffer-overread?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-126 |  |  | Detects buffer access beyond bounds | 🟢 |  |  |  |  |  |
+| [no-cryptojs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-1104 | A06:2021 |  | Disallow deprecated crypto-js library (use native crypto instead) | 🟢 |  |  |  |  |  |
+| [no-cryptojs-weak-random](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-cryptojs-weak-random?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-338 | A02:2021 |  | Disallow crypto-js WordArray.random() (CVE-2020-36732) | 🟢 |  |  |  |  |  |
+| [no-data-in-temp-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-data-in-temp-storage?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-312 |  |  | Temporary directories (/tmp, /var/tmp, temp/) are often world-readable or persist longer than expected | 🟢 |  |  |  |  |  |
+| [no-deprecated-buffer](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-deprecated-buffer?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-676 |  |  | Disallow the deprecated `new Buffer()` constructor and `Buffer()` factory call. | 🟢 |  |  |  | 💡 |  |
+| [no-deprecated-cipher-method](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-deprecated-cipher-method?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow deprecated crypto.createCipher/createDecipher methods | 🟢 |  |  |  |  |  |
+| [no-dynamic-dependency-loading](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-dependency-loading?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-1104 |  |  | This rule detects dynamically constructed paths in require() and import() statements | 🟢 |  |  |  |  |  |
+| [no-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-require?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) |  |  |  | Forbid require() calls with non-literal arguments | 🟢 |  |  |  |  |  |
+| [no-ecb-mode](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ecb-mode?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow ECB encryption mode (use GCM or CBC instead) | 🟢 |  |  |  |  |  |
+| [no-insecure-key-derivation](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-key-derivation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-916 | A02:2021 |  | Disallow PBKDF2 with insufficient iterations (< 100,000) | 🟢 |  |  |  |  |  |
+| [no-insecure-rsa-padding](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-rsa-padding?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow RSA PKCS#1 v1.5 padding (CVE-2023-46809 Marvin Attack) | 🟢 |  |  |  |  |  |
+| [no-math-random-crypto](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-math-random-crypto?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-338 | A02:2021 |  | Disallow Math.random() for cryptographic purposes (tokens, keys, secrets) | 🟢 |  | ⚠️ |  | 💡 |  |
+| [no-pii-in-logs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-pii-in-logs?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-532 |  |  | CWE: [CWE-532](https://cwe.mitre.org/data/definitions/532.html) | 🟢 |  |  |  |  |  |
+| [no-self-signed-certs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-self-signed-certs?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-295 | A07:2021 |  | Disallow rejectUnauthorized false in TLS options | 🟢 |  |  |  |  |  |
+| [no-sha1-hash](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-sha1-hash?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow sha1() from crypto-hash package (use sha256 or sha512) | 🟢 |  |  |  |  |  |
+| [no-ssrf](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ssrf?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-918 | A10:2021 |  | Detect HTTP requests with user-controlled URLs (server-side request forgery). | 🟢 |  |  |  | 💡 |  |
+| [no-static-iv](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-static-iv?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-329 | A02:2021 |  | Disallow static or hardcoded initialization vectors (IVs) | 🟢 |  |  |  |  |  |
+| [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-timing-unsafe-compare?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-208 | A02:2021 |  | Disallow timing-unsafe comparison of secrets | 🟢 |  |  |  |  |  |
+| [no-toctou-vulnerability](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-toctou-vulnerability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-367 | A01:2021 |  | Detects Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerabilities in file system operations. | 🟢 |  |  |  |  |  |
+| [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-dynamic-require?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-494 |  |  | Disallows dynamic require() calls with non-literal arguments that could lead to security vulnerabilities | 🟢 |  |  |  |  |  |
+| [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-cipher-algorithm?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish, RC2, IDEA) | 🟢 |  |  |  |  |  |
+| [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-hash-algorithm?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow weak hash algorithms (MD5, MD4, SHA-1, RIPEMD) | 🟢 |  |  |  |  |  |
+| [no-zip-slip](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-zip-slip?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-22 |  |  | Detects zip slip/archive extraction vulnerabilities | 🟢 |  |  |  |  |  |
+| [prefer-native-crypto](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/prefer-native-crypto?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-1104 | A06:2021 |  | Prefer native crypto over third-party libraries | 🟢 |  |  |  |  |  |
+| [require-dependency-integrity](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-dependency-integrity?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-494 |  |  | CWE: [CWE-494](https://cwe.mitre.org/data/definitions/494.html) | 🟢 |  |  |  |  |  |
+| [require-secure-credential-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-credential-storage?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-312 |  |  | This rule detects when credentials are stored using localStorage.setItem() or fs.writeFile() without encryp… | 🟢 |  |  |  |  |  |
+| [require-secure-deletion](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-secure-deletion?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-459 |  |  | CWE: [CWE-459](https://cwe.mitre.org/data/definitions/459.html) | 🟢 |  |  |  |  |  |
+| [require-storage-encryption](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/require-storage-encryption?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-312 |  |  | CWE: [CWE-312](https://cwe.mitre.org/data/definitions/312.html) | 🟢 |  |  |  |  |  |
+<!-- AUTO-GENERATED:RULES_TABLE:END -->
 ## 🔗 Related ESLint Plugins
 
 Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with LLM-optimized error messages:
@@ -108,7 +120,7 @@ Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with L
 | :--- | :---: | :--- |
 | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
 | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
-| [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-crypto.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
+| [`eslint-plugin-node-security`](https://www.npmjs.com/package/eslint-plugin-node-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-node-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-node-security) | Node.js core-module security (fs, child_process, vm, crypto, Buffer). |
 | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
 | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
 | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
@@ -118,10 +130,19 @@ Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with L
 | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
 | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
 
+<!-- INTERLACE:STAR_CTA:START -->
+## ⭐ Support & follow
+
+If this plugin caught a real bug for you, **[star the repo](https://github.com/ofri-peretz/eslint)** — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and **[follow the writeups on Dev.to](https://dev.to/ofri-peretz)** for the benchmarks and security research behind these rules.
+
+[![GitHub stars](https://img.shields.io/github/stars/ofri-peretz/eslint?style=social)](https://github.com/ofri-peretz/eslint)
+
+<!-- INTERLACE:STAR_CTA:END -->
+
 ## 📄 License
 
 MIT © [Ofri Peretz](https://github.com/ofri-peretz)
 
 <p align="center">
-  <a href="https://eslint.interlace.tools/docs/security/plugin-node-security"><img src="https://eslint.interlace.tools/images/og-node-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
+  <a href="https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security"><img src="https://eslint.interlace.tools/images/og-node-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
 </p>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-security",
-  "version": "4.0.4",
+  "version": "4.2.0",
   "description": "Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, path, Buffer). Detects command injection, path traversal, code execution vulnerabilities with AI-parseable error messages.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -13,11 +13,15 @@
     "./types": {
       "types": "./src/types/index.d.ts",
       "default": "./src/types/index.js"
+    },
+    "./oxlint": {
+      "types": "./src/oxlint.d.ts",
+      "default": "./src/oxlint.js"
     }
   },
   "author": "Ofri Peretz <ofriperetzdev@gmail.com>",
   "license": "MIT",
-  "homepage": "https://github.com/ofri-peretz/eslint/tree/main/packages/eslint-plugin-node-security#readme",
+  "homepage": "https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-node-security",
   "repository": {
     "type": "git",
     "url": "https://github.com/ofri-peretz/eslint",
@@ -75,5 +79,14 @@
   "devDependencies": {
     "@typescript-eslint/parser": "^8.46.2",
     "@typescript-eslint/rule-tester": "^8.46.2"
+  },
+  "scripts": {
+    "build": "tsx ../../scripts/build-package.ts",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc -p tsconfig.lib.json --noEmit"
+  },
+  "peerDependencies": {
+    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
   }
-}
+}

package/src/index.js

@@ -11,10 +11,12 @@ const detect_eval_with_expression_1 = require("./rules/detect-eval-with-expressi
 const detect_non_literal_fs_filename_1 = require("./rules/detect-non-literal-fs-filename");
 const no_unsafe_dynamic_require_1 = require("./rules/no-unsafe-dynamic-require");
 const no_buffer_overread_1 = require("./rules/no-buffer-overread");
+const no_deprecated_buffer_1 = require("./rules/no-deprecated-buffer");
 const no_toctou_vulnerability_1 = require("./rules/no-toctou-vulnerability");
 const no_zip_slip_1 = require("./rules/no-zip-slip");
 const no_arbitrary_file_access_1 = require("./rules/no-arbitrary-file-access");
 const no_data_in_temp_storage_1 = require("./rules/no-data-in-temp-storage");
+const no_pii_in_logs_1 = require("./rules/no-pii-in-logs");
 const no_ssrf_1 = require("./rules/no-ssrf");
 // Migrated rules from secure-coding
 const detect_suspicious_dependencies_1 = require("./rules/detect-suspicious-dependencies");
@@ -31,6 +33,7 @@ const no_cryptojs_weak_random_1 = require("./rules/no-cryptojs-weak-random");
 const no_deprecated_cipher_method_1 = require("./rules/no-deprecated-cipher-method");
 const no_ecb_mode_1 = require("./rules/no-ecb-mode");
 const no_insecure_key_derivation_1 = require("./rules/no-insecure-key-derivation");
+const no_math_random_crypto_1 = require("./rules/no-math-random-crypto");
 const no_insecure_rsa_padding_1 = require("./rules/no-insecure-rsa-padding");
 const no_self_signed_certs_1 = require("./rules/no-self-signed-certs");
 const no_sha1_hash_1 = require("./rules/no-sha1-hash");
@@ -45,10 +48,12 @@ exports.rules = {
     'detect-non-literal-fs-filename': detect_non_literal_fs_filename_1.detectNonLiteralFsFilename,
     'no-unsafe-dynamic-require': no_unsafe_dynamic_require_1.noUnsafeDynamicRequire,
     'no-buffer-overread': no_buffer_overread_1.noBufferOverread,
+    'no-deprecated-buffer': no_deprecated_buffer_1.noDeprecatedBuffer,
     'no-toctou-vulnerability': no_toctou_vulnerability_1.noToctouVulnerability,
     'no-zip-slip': no_zip_slip_1.noZipSlip,
     'no-arbitrary-file-access': no_arbitrary_file_access_1.noArbitraryFileAccess,
     'no-data-in-temp-storage': no_data_in_temp_storage_1.noDataInTempStorage,
+    'no-pii-in-logs': no_pii_in_logs_1.noPiiInLogs,
     'no-ssrf': no_ssrf_1.noSsrf,
     // Migrated rules
     'detect-suspicious-dependencies': detect_suspicious_dependencies_1.detectSuspiciousDependencies,
@@ -66,6 +71,7 @@ exports.rules = {
     'no-ecb-mode': no_ecb_mode_1.noEcbMode,
     'no-insecure-key-derivation': no_insecure_key_derivation_1.noInsecureKeyDerivation,
     'no-insecure-rsa-padding': no_insecure_rsa_padding_1.noInsecureRsaPadding,
+    'no-math-random-crypto': no_math_random_crypto_1.noMathRandomCrypto,
     'no-self-signed-certs': no_self_signed_certs_1.noSelfSignedCerts,
     'no-sha1-hash': no_sha1_hash_1.noSha1Hash,
     'no-static-iv': no_static_iv_1.noStaticIv,
@@ -77,7 +83,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-node-security',
-        version: '1.0.0',
+        version: '4.2.0',
     },
     rules: exports.rules,
 };
@@ -86,7 +92,17 @@ const recommendedRules = {
     'node-security/detect-eval-with-expression': 'error',
     'node-security/detect-non-literal-fs-filename': 'error',
     'node-security/no-unsafe-dynamic-require': 'error',
-    'node-security/no-buffer-overread': 'error',
+    // no-buffer-overread demoted 2026-05-09 — 95% of Wild hits on adversarial
+    // Edge corpus + insufficient fixture coverage for the README §1 promotion
+    // gate. Per `npm run ilb:severity-audit` it's both edge-error AND
+    // volume-error risk. Promote back to 'error' once Edge ratio drops to
+    // ≤ 50% (see `benchmarks/AUDIT_PATTERNS.md` §3.6 — needs typed-array
+    // detection like `detect-object-injection` got in audit iter-1).
+    'node-security/no-buffer-overread': 'warn',
+    // Added in 4.1.0. Set to 'warn' in `recommended` to avoid breaking
+    // adopters who already use the preset and have legacy `Buffer()` calls.
+    // Promote to 'error' on the next major bump.
+    'node-security/no-deprecated-buffer': 'warn',
     'node-security/no-toctou-vulnerability': 'error',
     'node-security/no-zip-slip': 'error',
     'node-security/no-arbitrary-file-access': 'error',
@@ -101,6 +117,7 @@ const recommendedRules = {
     'node-security/no-weak-cipher-algorithm': 'error',
     'node-security/no-static-iv': 'error',
     'node-security/no-ecb-mode': 'error',
+    'node-security/no-math-random-crypto': 'error',
     'node-security/no-cryptojs': 'warn',
 };
 exports.configs = {
@@ -114,7 +131,10 @@ exports.configs = {
         plugins: {
             'node-security': exports.plugin,
         },
-        rules: Object.fromEntries(Object.keys(exports.rules).map(ruleName => [`node-security/${ruleName}`, 'error'])),
+        rules: Object.fromEntries(Object.keys(exports.rules).map((ruleName) => [
+            `node-security/${ruleName}`,
+            'error',
+        ])),
     },
 };
 exports.default = exports.plugin;

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/eslint-plugin-node-security/src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AAEzC,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAAoE;IACpF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IAEjB,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,kCAAkC,EAAE,OAAO;IAC3C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,OAAO;IAEhC,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,OAAO;IAClC,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,2BAA2B,EAAE,MAAM;CACpC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,iBAAiB,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC,CAC3E;KACmC;CACvC,CAAC;AAGF,kBAAe,cAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,2DAAqD;AACrD,6CAAyC;AAEzC,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,gBAAgB,EAAE,4BAAW;IAC7B,SAAS,EAAE,gBAAM;IAEjB,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,MAAM;IAC5C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,OAAO;IAEhC,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,OAAO;IAClC,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,MAAM;CACpC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}

package/src/oxlint.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * oxlint sub-export.
+ *
+ * Consumers wire oxlint to this entry via:
+ *   { "jsPlugins": ["eslint-plugin-node-security/oxlint"] }
+ *
+ * oxlint's JS plugin loader does `require('eslint-plugin-node-security/oxlint')` and reads
+ * `.rules` off the result. The compiled output of `export = plugin` is
+ * `module.exports = plugin`, which gives oxlint the plugin object directly
+ * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
+ *
+ * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
+ */
+import { plugin } from './index';
+export = plugin;

package/src/oxlint.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * oxlint sub-export.
+ *
+ * Consumers wire oxlint to this entry via:
+ *   { "jsPlugins": ["eslint-plugin-node-security/oxlint"] }
+ *
+ * oxlint's JS plugin loader does `require('eslint-plugin-node-security/oxlint')` and reads
+ * `.rules` off the result. The compiled output of `export = plugin` is
+ * `module.exports = plugin`, which gives oxlint the plugin object directly
+ * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
+ *
+ * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
+ */
+const index_1 = require("./index");
+module.exports = index_1.plugin;
+//# sourceMappingURL=oxlint.js.map

package/src/oxlint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint.js","sourceRoot":"","sources":["../../src/oxlint.ts"],"names":[],"mappings":";AAAA;;;;GAIG;AAEH;;;;;;;;;;;;GAYG;AAEH,mCAAiC;AAEjC,iBAAS,cAAM,CAAC"}

package/src/rules/detect-child-process/index.js

@@ -15,6 +15,7 @@ const COMMAND_PATTERNS = [
         vulnerability: 'command-injection',
         safeAlternatives: ['execFile', 'spawn'],
         example: {
+            // oxlint-disable-next-line no-template-curly-in-string
             bad: 'exec(`git clone ${repoUrl}`)',
             good: [
                 'execFile(\'git\', [\'clone\', repoUrl], {shell: false})',
@@ -28,7 +29,9 @@ const COMMAND_PATTERNS = [
         dangerous: true,
         vulnerability: 'command-injection',
         safeAlternatives: ['execFileSync', 'spawnSync'],
+        // oxlint-disable-next-line no-template-curly-in-string
         example: {
+            // oxlint-disable-next-line no-template-curly-in-string
             bad: 'execSync(`npm install ${packageName}`)',
             good: [
                 'execFileSync(\'npm\', [\'install\', packageName], {shell: false})',
@@ -127,7 +130,11 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-child-process.md',
             description: 'Detects child_process usage that may allow command injection',
+            cwe: 'CWE-78',
+            cvss: 9.5,
+            confidence: 'medium',
         },
         messages: {
             // 🎯 Token optimization: 44% reduction (55→31 tokens) - removes ❌/✅/📚 labels
@@ -270,6 +277,7 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
         /**
          * Check if a node contains string interpolation or concatenation
          */
+        // oxlint-disable-next-line consistent-function-scoping
         const containsDynamicStrings = (node) => {
             if (node.type === 'TemplateLiteral') {
                 return node.expressions.length > 0;
@@ -353,7 +361,7 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                         return argNode.expressions.some(e => e.type === 'Identifier' && validatedVarNames.has(e.name));
                     }
                     if (argNode.type === eslint_devkit_1.AST_NODE_TYPES.ArrayExpression) {
-                        return argNode.elements.some(el => el != null && check(el));
+                        return argNode.elements.some(el => el !== null && check(el));
                     }
                     return false;
                 };
@@ -462,7 +470,7 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             else if (node.callee.type === 'Identifier') {
                 method = node.callee.name;
             }
-            const sourceCode = context.sourceCode || context.sourceCode;
+            const sourceCode = context.sourceCode;
             const args = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
             const pattern = COMMAND_PATTERNS.find(p => p.method === method) || null;
             // Check if arguments contain dynamic content
@@ -472,6 +480,7 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
         /**
          * Generate refactoring steps based on the pattern
          */
+        // oxlint-disable-next-line consistent-function-scoping
         const generateRefactoringSteps = (pattern) => {
             switch (pattern.method) {
                 case 'exec':
@@ -544,6 +553,7 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
         /**
          * Determine risk level based on the call pattern
          */
+        // oxlint-disable-next-line consistent-function-scoping
         const determineRiskLevel = (pattern, isDynamic) => {
             if (pattern?.dangerous && isDynamic) {
                 return 'critical';
@@ -587,21 +597,31 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 return;
             }
             const { method, args, pattern, isDynamic } = extractCommandInfo(node);
-            // Allow literal strings if configured
+            // ALWAYS safe: exec/execSync called with a single string literal that
+            // contains no interpolation — there is no user input to inject. The
+            // rule discourages exec() in general (because it's easy to add a
+            // template-literal later), but a fully-literal call is structurally
+            // safe and shouldn't be flagged. Fire-on-stylistic-discouragement is
+            // out of scope for a security rule.
+            if ((method === 'exec' || method === 'execSync') && !isDynamic && hasOnlyLiteralArgs(node.arguments)) {
+                return;
+            }
+            // Allow literal strings if configured (legacy option, kept for
+            // backward compat with existing user configs).
             if (allowLiteralStrings && method === 'exec' && !isDynamic) {
                 return;
             }
             // Allow safe methods with literal args if configured
             // execFile, execFileSync, spawn, spawnSync are inherently safer than exec
             // when using literal command + literal args array
-            const saferMethods = ['spawn', 'spawnSync', 'execFile', 'execFileSync'];
-            if (allowLiteralSpawn && saferMethods.includes(method) && hasOnlyLiteralArgs(node.arguments)) {
+            const saferMethods = new Set(['spawn', 'spawnSync', 'execFile', 'execFileSync']);
+            if (allowLiteralSpawn && saferMethods.has(method) && hasOnlyLiteralArgs(node.arguments)) {
                 return;
             }
             // ALWAYS safe: literal command + ALL literal args (no dynamic input at all).
             // For execFile/execFileSync: no shell by default, all-literal = nothing to inject.
             // For spawn/spawnSync: requires shell:false + all-literal args.
-            if (saferMethods.includes(method) && hasOnlyLiteralArgs(node.arguments)) {
+            if (saferMethods.has(method) && hasOnlyLiteralArgs(node.arguments)) {
                 const isExecFile = method === 'execFile' || method === 'execFileSync';
                 if (isExecFile || hasShellFalseOption(node)) {
                     return;