⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Security rules for Node.js core modules (fs, child_process, crypto, etc).

• Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
• How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
• What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-node-security --save-dev

⚙️ Configuration Presets

| Preset | Description | | :------------ | :---------------------------------------------------- | | recommended | Balanced security for most Node.js projects | | strict | Maximum security enforcement (all rules as errors) | | fs-security | Focus on file system vulnerabilities (CWE-22, CWE-73) | | crypto | Cryptographic security rules only |

💡 What You Get

• 31 security rules covering Node.js core module vulnerabilities
• Command Injection Detection for child_process.exec, spawn, and execFile
• Path Traversal Prevention for fs module operations
• TOCTOU Race Condition Detection for file system operations
• Cryptographic Security for weak algorithms and key management
• LLM-optimized messages with CWE references and fix guidance

📦 Compatibility

| Package | Version | | :--- | :--- | | ESLint | ^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0 | | Node.js | >=18.0.0 |

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

| Icon | Description | | :---: | :--- | | 💼 | Recommended: Included in the recommended preset. | | ⚠️ | Warns: Set to warn in recommended preset. | | 🔧 | Auto-fixable: Automatically fixable by the --fix CLI option. | | 💡 | Suggestions: Providing code suggestions in IDE. | | 🚫 | Deprecated: This rule is deprecated. | | 🟢 | Type-unaware: AST-only, runs in oxlint JS-plugin tier. | | 🟡 | Type-aware (refining): pure-AST primary path; types refine precision. | | 🟠 | Type-aware (graceful): requires TS program; silent without it. |

| Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 | | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: | | detect-child-process | CWE-78 | | | Detects instances of childprocess & non-literal exec() calls that may allow command injection | 🟢 | 💼 | | | | | | detect-eval-with-expression | CWE-95 | A03:2021 | | Detects eval(variable) which can allow an attacker to run arbitrary code inside your process | 🟢 | 💼 | | | | | | detect-non-literal-fs-filename | CWE-22 | | | Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your… | 🟢 | | ⚠️ | | | | | detect-suspicious-dependencies | CWE-506 | | | This rule detects package imports that look like typosquatting attempts on popular npm packages | 🟢 | | ⚠️ | | | | | lock-file | CWE-829 | | | CWE: CWE-829 | 🟢 | | | | | | | no-arbitrary-file-access | CWE-22 | A01:2021 | | Prevents file system access with unsanitized user input to protect against path traversal attacks. | 🟢 | 💼 | | | | | | no-buffer-overread | CWE-126 | | | Detects buffer access beyond bounds | 🟢 | | ⚠️ | | | | | no-cryptojs | CWE-1104 | A06:2021 | | Disallow deprecated crypto-js library (use native crypto instead) | 🟢 | 💼 | | | | | | no-cryptojs-weak-random | CWE-338 | A02:2021 | | Disallow crypto-js WordArray.random() (CVE-2020-36732) | 🟢 | | | | | | | no-data-in-temp-storage | CWE-312 | | | Temporary directories (/tmp, /var/tmp, temp/) are often world-readable or persist longer than expected | 🟢 | 💼 | | | | | | no-deprecated-buffer | CWE-676 | | | Disallow the deprecated new Buffer() constructor and Buffer() factory call. | 🟢 | 💼 | | | 💡 | | | no-deprecated-cipher-method | CWE-327 | A02:2021 | | Disallow deprecated crypto.createCipher/createDecipher methods | 🟢 | | | | | | | no-dynamic-algorithm-selection | CWE-327 | A02:2021 | | Disallow dynamic algorithm names in Node.js crypto functions (CWE-327) | 🟢 | 💼 | | | | | | no-dynamic-command-string | CWE-77 | A03:2021 | | Detects dynamically assembled command strings handed to a shell flag (bash -c) or to a command-runner that… | 🟢 | 💼 | | | | | | no-dynamic-dependency-loading | CWE-1104 | | | This rule detects dynamically constructed paths in require() and import() statements | 🟢 | | | | | | | no-dynamic-require | | | | Forbid require() calls with non-literal arguments | 🟢 | | | | | | | no-ecb-mode | CWE-327 | A02:2021 | | Disallow ECB encryption mode (use GCM or CBC instead) | 🟢 | 💼 | | | | | | no-env-injection | CWE-99 | A03:2021 | | Detects writes to process.env under a key the caller controls, which can overwrite PATH, NODE_OPTIONS or LD… | 🟢 | 💼 | | | | | | no-insecure-http-parser | CWE-444 | A03:2021 | | Disallow insecureHTTPParser true on Node HTTP servers and clients | 🟢 | 💼 | | | | | | no-insecure-key-derivation | CWE-916 | A02:2021 | | Disallow PBKDF2 with insufficient iterations (< 100,000) | 🟢 | | | | | | | no-insecure-rsa-padding | CWE-327 | A02:2021 | | Disallow RSA PKCS#1 v1.5 padding (CVE-2023-46809 Marvin Attack) | 🟢 | | | | | | | no-math-random-crypto | CWE-338 | A02:2021 | | Disallow Math.random() for cryptographic purposes (tokens, keys, secrets, salts, IVs) | 🟢 | 💼 | | | | | | no-self-signed-certs | CWE-295 | A07:2021 | | Disallow rejectUnauthorized false in TLS options | 🟢 | 💼 | | | | | | no-sha1-hash | CWE-327 | A02:2021 | | Disallow sha1() from crypto-hash package (use sha256 or sha512) | 🟢 | | | | | | | no-shell-injection | CWE-78 | A03:2021 | | Disallow string concatenation or template expressions in shell command arguments (CWE-78) | 🟢 | 💼 | | | | | | no-ssrf | CWE-918 | A10:2021 | | Detect HTTP requests with user-controlled URLs (server-side request forgery). | 🟢 | | ⚠️ | | 💡 | | | no-static-iv | CWE-329 | A02:2021 | | Disallow static or hardcoded initialization vectors (IVs) | 🟢 | 💼 | | | | | | no-timing-unsafe-compare | CWE-208 | A02:2021 | | Disallow timing-unsafe comparison of secrets | 🟢 | | ⚠️ | | | | | no-toctou-vulnerability | CWE-367 | A01:2021 | | Detects Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerabilities in file system operations. | 🟢 | 💼 | | | | | | no-unbounded-decompression | CWE-409 | A05:2021 | | Require a maxOutputLength ceiling on zlib one-shot decompression | 🟢 | 💼 | | | | | | no-unsafe-buffer-alloc | CWE-908 | A01:2021 | | Disallow Buffer.allocUnsafe() and Buffer.allocUnsafeSlow(), which return uninitialized memory. | 🟢 | | ⚠️ | | 💡 | | | no-unsafe-dynamic-require | CWE-494 | | | Disallows dynamic require() calls with non-literal arguments that could lead to security vulnerabilities | 🟢 | 💼 | | | | | | no-weak-cipher-algorithm | CWE-327 | A02:2021 | | Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish, RC2, IDEA) | 🟢 | 💼 | | | | | | no-weak-dh-parameters | CWE-326 | A04:2025 | | Disallow Diffie-Hellman and ECDH parameters below a safe strength | 🟢 | 💼 | | | | | | no-weak-hash-algorithm | CWE-327 | A02:2021 | | Disallow weak hash algorithms (MD5, MD4, SHA-1, RIPEMD) | 🟢 | 💼 | | | | | | no-zip-slip | CWE-22 | | | Detects zip slip/archive extraction vulnerabilities | 🟢 | 💼 | | | | | | prefer-native-crypto | CWE-1104 | A06:2021 | | Prefer native crypto over third-party libraries | 🟢 | | | | | | | require-aead-tag-verification | CWE-327 | A02:2021 | | Require AEAD decryption to verify the authentication tag (setAuthTag + final) | 🟢 | 💼 | | | | | | require-dependency-integrity | CWE-494 | | | CWE: CWE-494 | 🟢 | 💼 | | | | | | require-secure-credential-storage | CWE-312 | | | This rule detects a credential written to localStorage, sessionStorage, AsyncStorage or process.env without… | 🟢 | | | | | | | require-secure-deletion | CWE-459 | | | CWE: CWE-459 | 🟢 | | | | | | | require-storage-encryption | CWE-312 | | | CWE: CWE-312 | 🟢 | | | | | | | require-stream-error-handler | CWE-248 | A04:2021 | | Require an error listener on streams passed to pipe, which does not forward errors | 🟢 | 💼 | | | | |

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

| Plugin | Downloads | Description | | :--- | :---: | :--- | | eslint-plugin-anthropic-security | | Anthropic SDK security. | | eslint-plugin-browser-security | | XSS, DOM security. | | eslint-plugin-drizzle-security | | Drizzle security. | | eslint-plugin-express-security | | Express middleware hardening. | | eslint-plugin-gemini-security | | Google Gemini SDK security. | | eslint-plugin-jwt-security | | Token security. | | eslint-plugin-knex-security | | Knex security. | | eslint-plugin-lambda-security | | AWS Lambda hardening. | | eslint-plugin-mcp-sdk-security | | MCP SDK security. | | eslint-plugin-mongodb-security | | MongoDB injection. | | eslint-plugin-mysql-security | | MySQL security. | | eslint-plugin-nestjs-security | | NestJS framework hardening. | | eslint-plugin-openai-security | | OpenAI SDK security. | | eslint-plugin-postgresql-security | | PostgreSQL security. | | eslint-plugin-prisma-security | | Prisma security. | | eslint-plugin-secure-coding | | Injection prevention. | | eslint-plugin-sequelize-security | | Sequelize ORM security. | | eslint-plugin-sqlite-security | | SQLite security. | | eslint-plugin-supabase-security | | Supabase security. | | eslint-plugin-typeorm-security | | TypeORM security. | | eslint-plugin-vercel-ai-security | | AI SDK security. |

Code quality

| Plugin | Downloads | Description | | :--- | :---: | :--- | | eslint-plugin-cli-floor | | CLI floor for commander, yargs and burgee. | | eslint-plugin-conventions | | Team-specific habits and styles. | | eslint-plugin-import-next | | Fast cycle + import-graph analysis. | | eslint-plugin-maintainability | | Cognitive load and clean-code patterns. | | eslint-plugin-modernization | | ESNext migration + syntax evolution. | | eslint-plugin-modularity | | Structural integrity and DDD patterns. | | eslint-plugin-operability | | Production readiness and resource health. | | eslint-plugin-react-a11y | | React accessibility / WCAG. | | eslint-plugin-react-features | | React best practices and optimization. | | eslint-plugin-reliability | | Runtime stability and error safety. |

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz