eslint-plugin-conventions

Team Conventions

Enforce consistent patterns across your team with customizable rule configurations.

Install

npm install -D eslint-plugin-conventions

Changelog

View version history and updates

Live from GitHub

This content is fetched directly from README.md on GitHub and cached for 1 hour.

Live README from GitHubfrom eslint-plugin-conventions/README.md, cached for 1 hour.Edit on GitHub

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Project conventions: naming, file structure, and code style consistency.

Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-conventions --save-dev

⚙️ Configuration Presets

Preset	Description
`recommended`	Balanced conventions for most teams

🏢 Usage Example

// eslint.config.js
import conventions from 'eslint-plugin-conventions';

export default [conventions.configs.recommended];

📦 Compatibility

Package	Version
ESLint	`^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0`
Node.js	`>=18.0.0`

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

Icon	Description
💼	Recommended: Included in the recommended preset.
⚠️	Warns: Set to warn in recommended preset.
🔧	Auto-fixable: Automatically fixable by the `--fix` CLI option.
💡	Suggestions: Providing code suggestions in IDE.
🚫	Deprecated: This rule is deprecated.
🟢	Type-unaware: AST-only, runs in oxlint JS-plugin tier.
🟡	Type-aware (refining): pure-AST primary path; types refine precision.
🟠	Type-aware (graceful): requires TS program; silent without it.

Rule	CWE	Description	🧠	💼	⚠️	💡
analytics-event-naming		Analytics event names (track/capture) must follow ANALYTICS_PHILOSOPHY.md principle 4: lowercase snake_case…	🟢	💼
consistent-existence-index-check		Enforce consistent style for checking if an element exists in an array	🟢			💡
expiring-todo-comments		Add expiration conditions to TODO comments to prevent forgotten tasks. This rule is part of eslint-plugin-c…	🟢		⚠️	💡
filename-case		Enforce filename case conventions for consistency across your codebase	🟢			💡
no-commented-code		ESLint Rule: no-commented-code with LLM-optimized suggestions and auto-fix capabilities.	🟢		⚠️	💡
no-console-spaces		Disallow leading/trailing whitespace in console arguments. This rule is part of eslint-plugin-conventions.	🟢			💡
no-deprecated-api	CWE-1078	Prevent usage of deprecated APIs with migration context and timeline. This rule is part of eslint-plugin-co…	🟢		⚠️	💡
no-json-schema-tags		Disallow JSON Schema keywords (e.g. @minimum, @maximum, @pattern, @format) used as JSDoc tags.	🟢			💡
no-magic-numbers		Disallow magic numbers (numeric literals without a named constant)	🟢			💡
no-raw-cross-property-href		Forbid hand-written cross-property hrefs; use buildUtmHref() from lib/utm.ts	🟢	💼
prefer-code-point		Prefer String.codePointAt() over String.charCodeAt(). This rule is part of eslint-plugin-conventions.	🟢			💡
prefer-dependency-version-strategy		Enforce consistent version strategy (caret ^, tilde ~, exact, range, or any) for package.json dependencies.…	🟢			💡
prefer-dom-node-text-content		Prefer textContent over innerText. This rule is part of eslint-plugin-conventions.	🟢			💡
require-data-testid		Require stable data-testid attributes on interactive elements for end-to-end test reliability	🟢			💡
utm-taxonomy		Validate utm_source and utm_medium values against the fixed taxonomy in UTM_PHILOSOPHY.md	🟢	💼

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
`eslint-plugin-anthropic-security`		Anthropic SDK security.
`eslint-plugin-browser-security`		XSS, DOM security.
`eslint-plugin-drizzle-security`		Drizzle security.
`eslint-plugin-express-security`		Express middleware hardening.
`eslint-plugin-gemini-security`		Google Gemini SDK security.
`eslint-plugin-jwt-security`		Token security.
`eslint-plugin-knex-security`		Knex security.
`eslint-plugin-lambda-security`		AWS Lambda hardening.
`eslint-plugin-mcp-sdk-security`		MCP SDK security.
`eslint-plugin-mongodb-security`		MongoDB injection.
`eslint-plugin-mysql-security`		MySQL security.
`eslint-plugin-nestjs-security`		NestJS framework hardening.
`eslint-plugin-node-security`		Server-side patterns.
`eslint-plugin-openai-security`		OpenAI SDK security.
`eslint-plugin-postgresql-security`		PostgreSQL security.
`eslint-plugin-prisma-security`		Prisma security.
`eslint-plugin-secure-coding`		Injection prevention.
`eslint-plugin-sequelize-security`		Sequelize ORM security.
`eslint-plugin-sqlite-security`		SQLite security.
`eslint-plugin-supabase-security`		Supabase security.
`eslint-plugin-typeorm-security`		TypeORM security.
`eslint-plugin-vercel-ai-security`		AI SDK security.

Code quality

Plugin	Downloads	Description
`eslint-plugin-import-next`		Fast cycle + import-graph analysis.
`eslint-plugin-maintainability`		Cognitive load and clean-code patterns.
`eslint-plugin-modernization`		ESNext migration + syntax evolution.
`eslint-plugin-modularity`		Structural integrity and DDD patterns.
`eslint-plugin-operability`		Production readiness and resource health.
`eslint-plugin-react-a11y`		React accessibility / WCAG.
`eslint-plugin-react-features`		React best practices and optimization.
`eslint-plugin-reliability`		Runtime stability and error safety.

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

View README.md on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarks Star on GitHub