ESLint plugins that find security bugs in JavaScript and TypeScript
Including the bugs AI coding tools write. Free and open source.
Runs under
- ESLintfloor
- Oxlintautomated peer
- Biomereserved peer
- TSC native (Go)watching
Pick the engine your team picks — your rules come along, with CI-enforced diagnostic parity. How it works →
See it in action
Clean configuration, powerful protection. Works with ESLint 8 and 9, flat config or legacy.
npm install -D eslint-plugin-browser-security eslint-plugin-jwt-securityimport browserSecurity from 'eslint-plugin-browser-security';
import jwt from 'eslint-plugin-jwt-security';
export default [
browserSecurity.configs.recommended,
jwt.configs.recommended,
// Start protecting your code instantly
];What it catches
Real vulnerabilities in real code. Every rule maps to a CWE so AI agents and humans can act on the same signal.
pg/no-unsafe-querySQL injection
db.query(
`SELECT * FROM users WHERE id = ${id}`,
)jwt/no-algorithm-noneJWT algorithm confusion
jwt.verify(token, secret, {
algorithms: ['none'],
})browser-security/no-innerhtmlXSS via innerHTML
el.innerHTML = userInput;Featured on DEV
Articles about these plugins that DEV Community featured and shared.
Security and code quality
The plugins come in two groups. Install only the ones you need.
Security
22 plugins protecting against XSS, injection, insecure tokens, and common vulnerability patterns.
Quality & Architecture
8 plugins enforcing conventions, modularity, reliability, and modern best practices.
How it works
Three short reads that explain the model. Skim before you install — or come back when a rule surprises you.
Why use these
What you get beyond the rules themselves.
Compatibility
ESLint 8, 9, and forward to v10. Flat config and legacy. Type-aware where it matters, type-unaware where it doesn't — fast by default.
Runtime Portability
One rule library, multiple engines. Runs under ESLint and Oxlint today with CI-enforced parity. Biome and the TSC native plugin host (Go) on the roadmap — switch engines without rewriting rules.
Benchmarks
497+ rules across 32+ plugins, with head-to-head data refreshed weekly from real npm download share.
AI Leverage
LLM-optimized error messages, structured CWE metadata, and ESLint MCP support so coding agents fix vulnerabilities without hallucinating.
