# eslint-plugin-security > Security rules for eslint Latest version **4.0.1** (published 2026-06-12) · Apache-2.0 license · 0 weekly downloads ## Install ```sh npm install eslint-plugin-security pnpm add eslint-plugin-security yarn add eslint-plugin-security bun add eslint-plugin-security ``` ## Health **Score 63/100 (C)** — status: active. Positive: has types package; no vulnerabilities; has provenance; high maintenance score; high quality score. Warnings: low downloads; no esm support. ## Facts | | | |---|---| | Version | 4.0.1 | | Published | 2026-06-12 | | First published | 2015-11-15 | | Weekly downloads | 0 | | License | Apache-2.0 | | TypeScript types | separate (@types/eslint-plugin-security) | | Module format | CommonJS | | Node | ^18.18.0 \|\| ^20.9.0 \|\| >=21.1.0 | | Dependencies | 1 | | Unpacked size | 145.1 KB | | Known vulnerabilities | 0 | | Install scripts | no | | Provenance | attested (GitHub Actions) | | GitHub stars | 2375 | | Author | Node Security Project | | Maintainers | nzakas, michaeldeboey, eslint-community-bot | | Keywords | eslint, security, nodesecurity | ## Links - npm: https://www.npmjs.com/package/eslint-plugin-security - Repository: https://github.com/eslint-community/eslint-plugin-security - Homepage: https://github.com/eslint-community/eslint-plugin-security#readme - Issues: https://github.com/eslint-community/eslint-plugin-security/issues - Funding: https://opencollective.com/eslint - npm.io page: https://npm.io/package/eslint-plugin-security ## Dependencies (1) - [safe-regex](https://npm.io/package/safe-regex.md) ^2.1.1 ## Alternatives - [eslint-plugin-sonarjs](https://npm.io/package/eslint-plugin-sonarjs.md) — 2.9M weekly downloads - [eslint-config-expo](https://npm.io/package/eslint-config-expo.md) — 1.5M weekly downloads - [@matter/protocol](https://npm.io/package/@matter/protocol.md) — 63.5K weekly downloads - [@eventcatalog/linter](https://npm.io/package/@eventcatalog/linter.md) — 24.8K weekly downloads - [@inrupt/eslint-config-base](https://npm.io/package/@inrupt/eslint-config-base.md) — 4.5K weekly downloads ## Recent versions - 4.0.1 (latest) — 2026-06-12 - 4.0.0 — 2026-02-19 - 3.0.1 — 2024-06-14 - 3.0.0 — 2024-04-10 - 2.1.1 — 2024-02-14 - 2.1.0 — 2023-12-15 - 2.0.0 — 2023-12-13 - 1.7.1 — 2023-02-02 - 1.7.0 — 2023-01-26 - 1.6.0 — 2023-01-11 - 1.5.0 — 2022-04-18 - 1.4.0 — 2017-06-13 - 1.3.0 — 2017-02-09 - 1.2.0 — 2016-01-22 - 1.1.0 — 2016-01-06 - … 1 more at https://npm.io/package/eslint-plugin-security/versions ## README # eslint-plugin-security [![NPM version](https://img.shields.io/npm/v/eslint-plugin-security.svg?style=flat)](https://npmjs.org/package/eslint-plugin-security) ESLint rules for Node Security This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human. ## Installation ```sh npm install --save-dev eslint-plugin-security ``` or ```sh yarn add --dev eslint-plugin-security ``` ## Usage ### Flat config (requires eslint >= v8.23.0) Add the following to your `eslint.config.js` file: ```js const pluginSecurity = require('eslint-plugin-security'); module.exports = [pluginSecurity.configs.recommended]; ``` ### eslintrc config (deprecated) Add the following to your `.eslintrc` file: ```js module.exports = { extends: ['plugin:security/recommended-legacy'], }; ``` ## Developer guide - Use [GitHub pull requests](https://help.github.com/articles/using-pull-requests). - Conventions: - We use our [custom ESLint setup](https://github.com/nodesecurity/eslint-config-nodesecurity). - Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing: ```sh npm run-script cont-int ``` ## Tests ```sh npm test ``` ## Rules ⚠️ Configurations set to warn in.\ ✅ Set in the `recommended` configuration. | Name                                  | Description | ⚠️ | | :------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------- | :-- | | [detect-bidi-characters](docs/rules/detect-bidi-characters.md) | Detects trojan source attacks that employ unicode bidi attacks to inject malicious code. | ✅ | | [detect-buffer-noassert](docs/rules/detect-buffer-noassert.md) | Detects calls to "buffer" with "noAssert" flag set. | ✅ | | [detect-child-process](docs/rules/detect-child-process.md) | Detects instances of "child_process" & non-literal "exec()" calls. | ✅ | | [detect-disable-mustache-escape](docs/rules/detect-disable-mustache-escape.md) | Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities. | ✅ | | [detect-eval-with-expression](docs/rules/detect-eval-with-expression.md) | Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process. | ✅ | | [detect-new-buffer](docs/rules/detect-new-buffer.md) | Detects instances of new Buffer(argument) where argument is any non-literal value. | ✅ | | [detect-no-csrf-before-method-override](docs/rules/detect-no-csrf-before-method-override.md) | Detects Express "csrf" middleware setup before "method-override" middleware. | ✅ | | [detect-non-literal-fs-filename](docs/rules/detect-non-literal-fs-filename.md) | Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system. | ✅ | | [detect-non-literal-regexp](docs/rules/detect-non-literal-regexp.md) | Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression. | ✅ | | [detect-non-literal-require](docs/rules/detect-non-literal-require.md) | Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk. | ✅ | | [detect-object-injection](docs/rules/detect-object-injection.md) | Detects "variable[key]" as a left- or right-hand assignment operand. | ✅ | | [detect-possible-timing-attacks](docs/rules/detect-possible-timing-attacks.md) | Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially. | ✅ | | [detect-pseudoRandomBytes](docs/rules/detect-pseudoRandomBytes.md) | Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect. | ✅ | | [detect-unsafe-regex](docs/rules/detect-unsafe-regex.md) | Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop. | ✅ | ## TypeScript support Type definitions for this package are managed by [DefinitelyTyped](https://github.com/DefinitelyTyped/DefinitelyTyped). Use [@types/eslint-plugin-security](https://www.npmjs.com/package/@types/eslint-plugin-security) for type checking. ```sh npm install --save-dev @types/eslint-plugin-security # OR yarn add --dev @types/eslint-plugin-security ``` --- _Source: https://npm.io/package/eslint-plugin-security · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._