eslint-plugin-crypto

24 specialized rules — LLM-optimized error messages with CWE, OWASP, and CVSS metadata.

When to Use

This plugin is designed for any JavaScript/TypeScript application using cryptographic operations:

Environment	Examples
Node.js Backend	Express, Fastify, NestJS, Koa
Browser Applications	Web Crypto API usage
Serverless	AWS Lambda, Vercel Functions, Cloudflare Workers
CLI Tools	Node.js scripts, build tools

Category	Threats
Weak Algorithms	MD5, SHA1, DES, RC4
Insecure Key Management	Hardcoded keys, weak key lengths
IV/Nonce Misuse	Static IVs, predictable salts
Mode of Operation	ECB mode, unauthenticated encryption

Covers both Node.js and browser — Works with crypto, node:crypto, and Web Crypto API patterns.

npm install --save-dev eslint-plugin-crypto

import crypto from 'eslint-plugin-crypto';

export default [crypto.configs.recommended];

npx eslint .

Preset	Description
`recommended`	Balanced security for most projects
`strict`	Maximum enforcement (all rules as errors)

Browse all rules with CWE and OWASP references:

Loading rules...

Initializing articles...