# eslint-plugin-security-node

> Create a security plugin for node.js

Latest version **1.1.4** (published 2024-01-03) · ISC license · 0 weekly downloads

## Install

```sh
npm install eslint-plugin-security-node
pnpm add eslint-plugin-security-node
yarn add eslint-plugin-security-node
bun add eslint-plugin-security-node
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.1.4 |
| Published | 2024-01-03 |
| First published | 2019-09-29 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=0.10.0 |
| Dependencies | 0 |
| Unpacked size | 148.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 106 |
| Author | gkouziik |
| Maintainers | gkouziik |
| Keywords | eslint, eslintplugin, eslint-plugin, nodesecurity, security |

## Links

- npm: https://www.npmjs.com/package/eslint-plugin-security-node
- Repository: https://github.com/gkouziik/eslint-plugin-security-node
- Issues: https://github.com/gkouziik/eslint-plugin-security-node/issues
- npm.io page: https://npm.io/package/eslint-plugin-security-node

## Alternatives

- [eslint-plugin-sonarjs](https://npm.io/package/eslint-plugin-sonarjs.md) — 2.9M weekly downloads
- [eslint-config-expo](https://npm.io/package/eslint-config-expo.md) — 1.5M weekly downloads
- [@matter/protocol](https://npm.io/package/@matter/protocol.md) — 63.5K weekly downloads
- [@eventcatalog/linter](https://npm.io/package/@eventcatalog/linter.md) — 24.8K weekly downloads
- [@inrupt/eslint-config-base](https://npm.io/package/@inrupt/eslint-config-base.md) — 4.5K weekly downloads

## Recent versions

- 1.1.4 (latest) — 2024-01-03
- 1.1.3 — 2024-01-03
- 1.1.2 — 2024-01-02
- 1.1.1 — 2022-01-22
- 1.1.0 — 2021-12-19
- 1.0.14 — 2020-11-11
- 1.0.13 — 2020-11-10
- 1.0.12 — 2020-03-01
- 1.0.11 — 2019-10-05
- 1.0.10 — 2019-10-04
- 1.0.9 — 2019-10-04
- 1.0.8 — 2019-10-04
- 1.0.7 — 2019-10-04
- 1.0.6 — 2019-10-01
- 1.0.5 — 2019-09-30
- … 5 more at https://npm.io/package/eslint-plugin-security-node/versions

## README

# eslint-plugin-security-node

ESLint plugin containing Node.js security rules

This plugin will help to identify potential threats and prevent attacks.


## Installation

```sh
npm install --save-dev eslint-plugin-security-node
```

## Usage

Add the following configuration to your ```.eslintrc``` file:

```
"plugins": [
    "security-node"
],
"extends": [
    "plugin:security-node/recommended"
]
```


## Developer guide

* Use [GitHub pull requests](https://help.github.com/en/articles/about-pull-requests)
* Check the .eslintrc file to see the ESLint setup

## Tests

Type the following to test all the rules:
```sh
$ npm test
```

Type the following to test a particular rule:
```sh
$ ./node_modules/.bin/mocha tests/lib/rules/rule_name
```

## Rules


### `detect non literal regular expr`

For details check the documentation file [non-literal-reg-expr](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/non-literal-reg-expr.md)

### `detect absence of property:name in express-session`

For details check the documentation file [detect-absence-of-name-option-in-exrpress-session](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-absence-of-name-option-in-exrpress-session.md)

### `detect Buffer unsafe allocation`

For details check the documentation file [detect-buffer-unsafe-allocation](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-buffer-unsafe-allocation.md)

### `detect exec of child_process with non-Literal argument`

For details check the documentation file [detect-child-process](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-child-process.md)

### `detect crlf attack`

For details check the documentation file [detect-crlf](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-crlf.md)

### `detect dangerous redirects`

For more information check the documentation file [detect-dangerous-redirects](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-dangerous-redirects.md)

### `detect-eval-with-expr`

For more information check the documentation file [detect-eval-with-expr](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-eval-with-expr.md)

### `detect-html-injection`

For more information check the documentation file [detect-html-injection](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-html-injection.md)

### `detect-insecure-randomness`

For more information check the documentation file [detect-insecure-randomness](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-insecure-randomness.md)

### `detect-non-literal-require-calls`

For more information check the documentation file [detect-non-literal-require-calls](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-non-literal-require-calls.md)

### `detect-nosql-injection`

For more information check the documentation file [detect-nosql-injection](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-nosql-injection.md)

### `detect-option-multiplestatements-in-mysql`

For more information check the documentation file [detect-option-multiplestatements-in-mysql](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-option-multiplestatements-in-mysql.md)

### `detect-option-rejectunauthorized-in-nodejs-httpsrequest`

For more information check the documentation file [detect-option-rejectunauthorized-in-nodejs-httpsrequest](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-option-rejectunauthorized-in-nodejs-httpsrequest.md)

### `detect-option-unsafe-in-serialize-javascript-npm-package`

For more information check the documentation file [detect-option-unsafe-in-serialize-javascript-npm-package](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-option-unsafe-in-serialize-javascript-npm-package.md)

### `detect-possible-timing-attacks`

For more information check the documentation file [detect-possible-timing-attacks](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-possible-timing-attacks.md)

### `detect-runinthiscontext-method-in-nodes-vm`

For more information check the documentation file [detect-runinthiscontext-method-in-nodes-vm.](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-runinthiscontext-method-in-nodes-vm.md)

### `detect-security-missconfiguration-cookie`

For more information check the documentation file [detect-security-missconfiguration-cookie](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-security-missconfiguration-cookie.md)

### `detect-sql-injection`

For more information check the documentation file [detect-sql-injection](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-sql-injection.md)

### `disable-ssl-across-node-server`

For more information check the documentation file [disable-ssl-across-node-server](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/disable-ssl-across-node-server.md)

### `detect-improper-exception-handling`

For more information check the documentation file [detect-improper-exception-handling](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-improper-exception-handling.md)

### `detect-unhandled-async-errors`

For more information check the documentation file [detect-unhandled-async-errors](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-unhandled-async-errors.md)

### `detect-unhandled-event-errors`

For more information check the documentation file [detect-unhandled-event-errors](https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/detect-unhandled-event-errors.md)

### Changelog

All notable changes to this project will be documented in this file. Dates are displayed in UTC.

Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).

#### [1.1.3](https://github.com/gkouziik/eslint-plugin-security-node/compare/1.1.2...1.1.3)

- fix: potential error in isTryCatchStatement [`#63`](https://github.com/gkouziik/eslint-plugin-security-node/pull/63)
- updated Readme with changelog [`0520676`](https://github.com/gkouziik/eslint-plugin-security-node/commit/05206765562175acaacd03adcd4431d36f750947)
- test: update test [`922ded3`](https://github.com/gkouziik/eslint-plugin-security-node/commit/922ded32e2bc2ddd0d193079eb0d56b376496c4f)

#### 1.1.2

- Bump diff and mocha [`#74`](https://github.com/gkouziik/eslint-plugin-security-node/pull/74)
- Bump debug and mocha [`#73`](https://github.com/gkouziik/eslint-plugin-security-node/pull/73)
- Bump growl and mocha [`#72`](https://github.com/gkouziik/eslint-plugin-security-node/pull/72)
- Bump minimatch from 3.0.4 to 3.1.2 [`#71`](https://github.com/gkouziik/eslint-plugin-security-node/pull/71)
- Bump ansi-regex from 3.0.0 to 3.0.1 [`#70`](https://github.com/gkouziik/eslint-plugin-security-node/pull/70)
- Bump minimist, mkdirp and mocha [`#69`](https://github.com/gkouziik/eslint-plugin-security-node/pull/69)
- Bump ajv from 6.10.0 to 6.12.6 [`#62`](https://github.com/gkouziik/eslint-plugin-security-node/pull/62)
- Added release-it script [`#78`](https://github.com/gkouziik/eslint-plugin-security-node/pull/78)
- Request to add new rules [`#60`](https://github.com/gkouziik/eslint-plugin-security-node/pull/60)
- Fix headings [`#61`](https://github.com/gkouziik/eslint-plugin-security-node/pull/61)
- Revisions for new rules [`#2`](https://github.com/gkouziik/eslint-plugin-security-node/pull/2)
- chore: remove node_modules [`#59`](https://github.com/gkouziik/eslint-plugin-security-node/pull/59)
- add new rules [`#1`](https://github.com/gkouziik/eslint-plugin-security-node/pull/1)
- Bump lodash from 4.17.19 to 4.17.21 [`#58`](https://github.com/gkouziik/eslint-plugin-security-node/pull/58)
- Add docs urls to rules [`#57`](https://github.com/gkouziik/eslint-plugin-security-node/pull/57)
- remove remaining references to helmet without nocache [`#54`](https://github.com/gkouziik/eslint-plugin-security-node/pull/54)
- Remove noCache since it has been depricated [`#53`](https://github.com/gkouziik/eslint-plugin-security-node/pull/53)
- Fixed typos and improved grammar [`#50`](https://github.com/gkouziik/eslint-plugin-security-node/pull/50)
- Bump lodash from 4.17.15 to 4.17.19 [`#49`](https://github.com/gkouziik/eslint-plugin-security-node/pull/49)
- Bump acorn from 6.1.1 to 6.4.1 [`#48`](https://github.com/gkouziik/eslint-plugin-security-node/pull/48)
- fix: remove console logs in create functions [`#46`](https://github.com/gkouziik/eslint-plugin-security-node/pull/46)
- Bump lodash from 4.17.11 to 4.17.15 [`#44`](https://github.com/gkouziik/eslint-plugin-security-node/pull/44)
- Bump eslint-utils from 1.3.1 to 1.4.3 [`#43`](https://github.com/gkouziik/eslint-plugin-security-node/pull/43)
- Update Readme.md file [`#1`](https://github.com/gkouziik/eslint-plugin-security-node/pull/1)
- Changed package lock [`b0f2d6a`](https://github.com/gkouziik/eslint-plugin-security-node/commit/b0f2d6a57d5389af04ee2671ce03436b8d5e86d5)
- #21 Rule Ready tested [`0ca48df`](https://github.com/gkouziik/eslint-plugin-security-node/commit/0ca48df2e86e2503e735998bf536e2dfd16f6f7a)
- Deleted some files [`ce7d04d`](https://github.com/gkouziik/eslint-plugin-security-node/commit/ce7d04debe8a3d0308e617f73c57cc18b43ca09e)

---
_Source: https://npm.io/package/eslint-plugin-security-node · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._