eslint-plugin-maintainability

Readable Code

Reduce cognitive load and improve code readability with consistent patterns.

Install

npm install -D eslint-plugin-maintainability

Changelog

View version history and updates

Live from GitHub

This content is fetched directly from README.md on GitHub and cached for 1 hour.

Live README from GitHubfrom eslint-plugin-maintainability/README.md, cached for 1 hour.Edit on GitHub

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Maintainability rules — complexity ceilings, dead code, and readability guardrails.

Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-maintainability --save-dev

⚙️ Configuration Presets

Preset	Description
`recommended`	Recommended code quality rules as warnings

📦 Compatibility

Package	Version
ESLint	`^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0`
Node.js	`>=18.0.0`

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

Icon	Description
💼	Recommended: Included in the recommended preset.
⚠️	Warns: Set to warn in recommended preset.
🔧	Auto-fixable: Automatically fixable by the `--fix` CLI option.
💡	Suggestions: Providing code suggestions in IDE.
🚫	Deprecated: This rule is deprecated.
🟢	Type-unaware: AST-only, runs in oxlint JS-plugin tier.
🟡	Type-aware (refining): pure-AST primary path; types refine precision.
🟠	Type-aware (graceful): requires TS program; silent without it.

Rule	CWE	Description	🧠	⚠️	💡
cognitive-complexity		Enforces a maximum cognitive complexity threshold with refactoring guidance	🟢	⚠️	💡
consistent-function-scoping		Move functions to the highest possible scope	🟢		💡
error-message		Enforce providing a message when creating built-in Error objects for better debugging	🟢		💡
identical-functions	CWE-1104	Detects duplicate function implementations with DRY refactoring suggestions	🟢	⚠️	💡
max-parameters		ESLint Rule: max-parameters with LLM-optimized suggestions and auto-fix capabilities.	🟢	⚠️	💡
nested-complexity-hotspots		ESLint Rule: nested-complexity-hotspots with LLM-optimized suggestions and auto-fix capabilities.	🟢		💡
no-lonely-if		Disallow if statements as the only statement in else blocks	🟢		💡
no-missing-error-context		ESLint Rule: no-missing-error-context with LLM-optimized suggestions and auto-fix capabilities.	🟢		💡
no-nested-ternary		Prevent nested ternary expressions for better readability	🟢		💡
no-silent-errors		ESLint Rule: no-silent-errors with LLM-optimized suggestions and auto-fix capabilities.	🟢		💡
no-unhandled-promise	CWE-1024	Disallow unhandled Promise rejections with LLM-optimized suggestions for proper async error handling	🟢		💡
no-unreadable-iife		Disallow unreadable IIFE (Immediately Invoked Function Expression) patterns	🟢		💡

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
`eslint-plugin-anthropic-security`		Anthropic SDK security.
`eslint-plugin-browser-security`		XSS, DOM security.
`eslint-plugin-drizzle-security`		Drizzle security.
`eslint-plugin-express-security`		Express middleware hardening.
`eslint-plugin-gemini-security`		Google Gemini SDK security.
`eslint-plugin-jwt-security`		Token security.
`eslint-plugin-knex-security`		Knex security.
`eslint-plugin-lambda-security`		AWS Lambda hardening.
`eslint-plugin-mcp-sdk-security`		MCP SDK security.
`eslint-plugin-mongodb-security`		MongoDB injection.
`eslint-plugin-mysql-security`		MySQL security.
`eslint-plugin-nestjs-security`		NestJS framework hardening.
`eslint-plugin-node-security`		Server-side patterns.
`eslint-plugin-openai-security`		OpenAI SDK security.
`eslint-plugin-postgresql-security`		PostgreSQL security.
`eslint-plugin-prisma-security`		Prisma security.
`eslint-plugin-secure-coding`		Injection prevention.
`eslint-plugin-sequelize-security`		Sequelize ORM security.
`eslint-plugin-sqlite-security`		SQLite security.
`eslint-plugin-supabase-security`		Supabase security.
`eslint-plugin-typeorm-security`		TypeORM security.
`eslint-plugin-vercel-ai-security`		AI SDK security.

Code quality

Plugin	Downloads	Description
`eslint-plugin-conventions`		Team-specific habits and styles.
`eslint-plugin-import-next`		Fast cycle + import-graph analysis.
`eslint-plugin-modernization`		ESNext migration + syntax evolution.
`eslint-plugin-modularity`		Structural integrity and DDD patterns.
`eslint-plugin-operability`		Production readiness and resource health.
`eslint-plugin-react-a11y`		React accessibility / WCAG.
`eslint-plugin-react-features`		React best practices and optimization.
`eslint-plugin-reliability`		Runtime stability and error safety.

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

View README.md on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarks Star on GitHub