eslint-plugin-crypto

v2.1.1

Published

7 days ago

Security-focused ESLint plugin with 24 AI-parseable rules for cryptographic best practices. Detects weak algorithms, insecure key handling, CVE-specific vulnerabilities, and deprecated crypto patterns.

Description

This plugin enforces cryptographic best practices and modern security standards specifically for Node.js environments. It assists developers in avoiding weak algorithms and insecure implementations by flagging potential risks directly in the code. By integrating these checks, you can ensure that your application's data protection measures are robust and compliant with industry standards.

Philosophy

Interlace fosters strength through integration. Instead of stacking isolated rules, we interlace security directly into your workflow to create a resilient fabric of code. We believe tools should guide rather than gatekeep, providing educational feedback that strengthens the developer with every interaction.

Getting Started

To check out the guide, visit eslint.interlace.tools. 📚
要查看中文指南, 请访问 eslint.interlace.tools. 📚
가이드 문서는 eslint.interlace.tools에서 확인하실 수 있습니다. 📚
ガイドは eslint.interlace.toolsでご確認ください。 📚
Para ver la guía, visita eslint.interlace.tools. 📚
للاطلاع على الدليل، قم بزيارة eslint.interlace.tools. 📚

npm install eslint-plugin-crypto --save-dev

💡 What You Get

24 security rules covering cryptographic best practices
CVE detection for CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
OWASP Top 10 coverage for cryptographic vulnerabilities
LLM-optimized messages with CWE references and fix guidance
Package support for crypto-hash, crypto-random-string, crypto-js

Features

🔐 24 Rules covering crypto best practices
🎯 CVE Detection (CVE-2023-46809, CVE-2020-36732, CVE-2023-46233)
🤖 AI-Optimized messages with CWE references
⚡ Auto-Fix suggestions where safe
📦 Package Support for crypto-hash, crypto-random-string, crypto-js

⚙️ Configuration Presets

📚 Supported Libraries

| Library | npm | Downloads | Detection | | ------------------ | ------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------- | | crypto (Node.js) | | - | Weak Algo, Key Length, Randomness | | crypto-js | | | Legacy patterns, Weak PRNG |

Examples

❌ Bad

// CVE-2023-46809: Marvin Attack
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_PADDING }, buffer);

// CWE-338: Weak random
const token = Math.random().toString(36);

// CWE-327: ECB mode leaks patterns
crypto.createCipheriv('aes-256-ecb', key, iv);

// CWE-208: Timing attack
if (userToken === storedToken) { ... }

✅ Good

// Use OAEP padding
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }, buffer);

// Secure random
const token = crypto.randomBytes(32).toString('hex');

// GCM provides authentication
crypto.createCipheriv('aes-256-gcm', key, iv);

// Constant-time comparison
if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) { ... }

Peer Dependencies (Optional)

{
  "crypto-hash": ">=3.0.0",
  "crypto-random-string": ">=4.0.0",
  "crypto-js": ">=4.0.0"
}

AI-Optimized Messages

This plugin is optimized for ESLint's Model Context Protocol (MCP), enabling AI assistants like Cursor, GitHub Copilot, and Claude to:

Understand the exact vulnerability type via CWE references
Apply the correct fix using structured guidance
Provide educational context to developers

// .cursor/mcp.json
{
  "mcpServers": {
    "eslint": {
      "command": "npx",
      "args": ["@eslint/mcp@latest"]
    }
  }
}

By providing this structured context (CWE, OWASP, Fix), we enable AI tools to reason about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the exact correct fix immediately.

Rules

Legend

| Icon | Description | | :--: | :----------------------------------------------------------------- | | 💼 | Recommended: Included in the recommended preset. | | ⚠️ | Warns: Set towarn in recommended preset. | | 🔧 | Auto-fixable: Automatically fixable by the --fix CLI option. | | 💡 | Suggestions: Providing code suggestions in IDE. | | 🚫 | Deprecated: This rule is deprecated. |

| Rule | CWE | OWASP | CVSS | Description | :-------------------------------------------------------------------------------------------------------------------- | :-----: | :------: | :--: | :---------- | no-weak-hash-algorithm | no-weak-cipher-algorithm | no-deprecated-cipher-method | no-static-iv | no-ecb-mode | no-insecure-key-derivation | no-hardcoded-crypto-key | require-random-iv | no-insecure-rsa-padding | no-cryptojs-weak-random | require-secure-pbkdf2-digest | no-math-random-crypto | no-predictable-salt | require-authenti | no-key-reuse | no-self-signed-certs | no-timing-unsafe-compare | require-key-length | no-web-crypto-export | no-sha1-hash | require-sufficient-length | no-numeric-only-tokens | no-cryptojs | prefer-native-crypto | 💼 | ⚠️ | 🔧 | 💡 | 🚫 | ----------------------------------------------------------------------- | :-: | :-: | :-: | :-: | :-: | | CWE-327 | A02:2025 | 7.5 | no-weak-hash-algorithm | 💼 | | | 💡 | | | CWE-327 | A02:2025 | 7.5 | no-weak-cipher-algorithm | 💼 | | | 💡 | | | CWE-327 | A02:2025 | 5.0 | no-deprecated-cipher-method | 💼 | | | 💡 | | | CWE-329 | A02:2025 | 7.5 | no-static-iv | 💼 | | | 💡 | | | CWE-327 | A02:2025 | 7.5 | no-ecb-mode | 💼 | | | 💡 | | | CWE-916 | A02:2025 | 7.5 | no-insecure-key-derivation | 💼 | | | 💡 | | | CWE-321 | A02:2025 | 9.8 | no-hardcoded-crypto-key | 💼 | | | 💡 | | | CWE-329 | A02:2025 | 7.5 | require-random-iv | 💼 | ⚠️ | | 💡 | | | CWE-327 | A02:2025 | 7.4 | no-insecure-rsa-padding | 💼 | | | 💡 | | | CWE-338 | A02:2025 | 5.3 | no-cryptojs-weak-random | 💼 | | | 💡 | | | CWE-916 | A02:2025 | 9.1 | require-secure-pbkdf2-digest | 💼 | | | 💡 | | | CWE-338 | A07:2025 | 5.3 | no-math-random-crypto | 💼 | | | 💡 | | | CWE-331 | A07:2025 | 7.5 | no-predictable-salt | 💼 | | | 💡 | | cated-encryption | CWE-327 | A04:2025 | 6.5 | require-authenticated-encryption | 💼 | ⚠️ | | 💡 | | | CWE-323 | A02:2025 | 7.5 | no-key-reuse | 💼 | ⚠️ | | 💡 | | | CWE-295 | A05:2025 | 7.5 | no-self-signed-certs | 💼 | | | 💡 | | | CWE-208 | A02:2025 | 5.9 | no-timing-unsafe-compare | 💼 | ⚠️ | | 💡 | | | CWE-326 | A02:2025 | 7.5 | require-key-length | 💼 | ⚠️ | | 💡 | | | CWE-321 | A02:2025 | 5.0 | no-web-crypto-export | 💼 | ⚠️ | | 💡 | | | CWE-327 | A02:2025 | 7.5 | no-sha1-hash | 💼 | | | 💡 | | | CWE-326 | A02:2025 | 7.5 | require-sufficient-length | 💼 | ⚠️ | | 💡 | | | CWE-330 | A07:2025 | 5.3 | no-numeric-only-tokens | 💼 | ⚠️ | | 💡 | | | CWE-327 | A02:2025 | 5.0 | no-cryptojs | 💼 | ⚠️ | | 💡 | | | CWE-327 | A05:2025 | 5.0 | prefer-native-crypto | 💼 | ⚠️ | | 💡 | |