eslint-plugin-lambda-security

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Security best practices for AWS Lambda functions (IAM, timeouts, environment).

• Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
• How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
• What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-lambda-security --save-dev

⚙️ Configuration Presets

📚 Supported Libraries

Library	npm	Downloads	Detection
aws-lambda			IAM, Logging, Timeouts
@aws-sdk/client-lambda			Credential Safety
middy			Middleware Security

🤖 AI-Optimized Messages

Every security rule produces a structured 2-line error message:

src/handlers/api.ts
  18:5   error  🔒 CWE-798 OWASP:SAS-2 CVSS:9.8 | Hardcoded AWS credentials detected | CRITICAL [SOC2,PCI-DSS]
                    Fix: Use credential provider chain or Lambda execution role | https://owasp.org/...

Each message includes:

• 🔒 CWE reference - vulnerability classification
• 📋 OWASP category - Serverless Top 10 mapping
• 📊 CVSS score - severity rating (0.0-10.0)
• 🏢 Compliance tags - affected frameworks (SOC2, PCI-DSS, HIPAA)
• ✅ Fix instruction - exact code to write
• 📚 Documentation link - learn more

By providing this structured context (CWE, OWASP, Fix), we enable AI tools to reason about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the exact correct fix immediately.

💡 What You Get

• Serverless-focused coverage: 5 rules targeting Lambda-specific vulnerabilities (credentials, CORS, secrets, logging).
• LLM-optimized & MCP-ready: Structured 2-line messages with CWE + OWASP + CVSS + concrete fixes so humans and AI auto-fixers stay aligned.
• Standards aligned: OWASP Serverless Top 10, CWE tagging, CVSS scoring in every finding for compliance mapping.
• Tiered presets: recommended, strict for fast policy rollout.
• Framework-aware: Detects Middy middleware, API Gateway response patterns, AWS SDK v3 clients.
• Low false positive rate: Context-aware detection with production heuristics.

⚙️ Configuration Options

All rules accept these common options:

{
  rules: {
    'lambda-security/no-hardcoded-credentials-sdk': ['error', {
      allowInTests: true // Default: true - skip test files
    }],
    'lambda-security/no-secrets-in-env': ['error', {
      allowInTests: true,
      additionalPatterns: ['CUSTOM_SECRET_*'] // Additional patterns to detect
    }]
  }
}

📦 Compatibility

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
eslint-plugin-anthropic-security		Anthropic SDK security.
eslint-plugin-browser-security		XSS, DOM security.
eslint-plugin-drizzle-security		Drizzle security.
eslint-plugin-express-security		Express middleware hardening.
eslint-plugin-gemini-security		Google Gemini SDK security.
eslint-plugin-jwt-security		Token security.
eslint-plugin-knex-security		Knex security.
eslint-plugin-mcp-sdk-security		MCP SDK security.
eslint-plugin-mongodb-security		MongoDB injection.
eslint-plugin-mysql-security		MySQL security.
eslint-plugin-nestjs-security		NestJS framework hardening.
eslint-plugin-node-security		Server-side patterns.
eslint-plugin-openai-security		OpenAI SDK security.
eslint-plugin-postgresql-security		PostgreSQL security.
eslint-plugin-prisma-security		Prisma security.
eslint-plugin-secure-coding		Injection prevention.
eslint-plugin-sequelize-security		Sequelize ORM security.
eslint-plugin-sqlite-security		SQLite security.
eslint-plugin-supabase-security		Supabase security.
eslint-plugin-typeorm-security		TypeORM security.
eslint-plugin-vercel-ai-security		AI SDK security.

Code quality

Plugin	Downloads	Description
eslint-plugin-conventions		Team-specific habits and styles.
eslint-plugin-import-next		Fast cycle + import-graph analysis.
eslint-plugin-maintainability		Cognitive load and clean-code patterns.
eslint-plugin-modernization		ESNext migration + syntax evolution.
eslint-plugin-modularity		Structural integrity and DDD patterns.
eslint-plugin-operability		Production readiness and resource health.
eslint-plugin-react-a11y		React accessibility / WCAG.
eslint-plugin-react-features		React best practices and optimization.
eslint-plugin-reliability		Runtime stability and error safety.

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz