Secure your code,
your style.
ESLint Interlace is a comprehensive security & quality plugin ecosystem. Built for modern JavaScript, designed for teams who care about code integrity.
Runs under
- ESLintfloor
- Oxlintautomated peer
- Biomereserved peer
- TSC native (Go)watching
Pick the engine your team picks — your rules come along, with CI-enforced diagnostic parity. How it works →
See it in action
Clean configuration, powerful protection. Works with ESLint 8 and 9, flat config or legacy.
npm install -D eslint-plugin-browser-security eslint-plugin-jwtpnpm add -D eslint-plugin-browser-security eslint-plugin-jwtyarn add --dev eslint-plugin-browser-security eslint-plugin-jwtbun add -d eslint-plugin-browser-security eslint-plugin-jwtimport browserSecurity from 'eslint-plugin-browser-security';
import jwt from 'eslint-plugin-jwt';
export default [
browserSecurity.configs.recommended,
jwt.configs.recommended,
// Start protecting your code instantly
];What it catches
Real vulnerabilities in real code. Every rule maps to a CWE so AI agents and humans can act on the same signal.
pg/no-unsafe-querySQL injection
db.query(
`SELECT * FROM users WHERE id = ${id}`,
)jwt/no-algorithm-noneJWT algorithm confusion
jwt.verify(token, secret, {
algorithms: ['none'],
})browser-security/no-innerhtmlXSS via innerHTML
el.innerHTML = userInput;Trusted by developers
Security insights from teams shipping production JavaScript.
Two Pillars of Excellence
Comprehensive coverage organized into Security and Quality categories.
Security
11 plugins protecting against XSS, injection, insecure tokens, and common vulnerability patterns.
Quality & Architecture
7 plugins enforcing conventions, modularity, reliability, and modern best practices.
How it works
Three short reads that explain the model. Skim before you install — or come back when a rule surprises you.
Our edges
The four places where Interlace pulls ahead of the rest of the JavaScript linting ecosystem.
Compatibility
ESLint 8, 9, and forward to v10. Flat config and legacy. Type-aware where it matters, type-unaware where it doesn't — fast by default.
Runtime Portability
One rule library, multiple engines. Runs under ESLint and Oxlint today with CI-enforced parity. Biome and the TSC native plugin host (Go) on the roadmap — switch engines without rewriting rules.
Benchmarks
355+ rules across 18+ plugins, with head-to-head data refreshed weekly from real npm download share.
AI Leverage
LLM-optimized error messages, structured CWE metadata, and ESLint MCP support so coding agents fix vulnerabilities without hallucinating.
