Skip to main content
interlace
Plugin: node-security

Changelog

Release history and version updates for eslint-plugin-node-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

5.6.1

  • Fixno-shell-injection now reports spawn/spawnSync/execFile/execFileSync when a truthy shell option routes an interpolated command string through /bin/sh. The rule matched only exec/execSync, so the shape its own docs print as incorrect — `spawn(tar -xzf ${archivePath}, { shell: true }) — went unreported by every rule in the plugin. Without a shell option these functions stay silent, since an interpolated program name is CWE-114 and belongs to detect-child-process`.

5.6.0

  • Fixno-weak-hash-algorithm sees ripemd160, not just ripemd

5.5.0

  • Featuredetect Diffie-Hellman and ECDH parameters below a safe strength

5.4.4

  • FixThe README logo now links to the plugin's own documentation.

5.4.3

  • FixA computed or quoted property key is still the same property.

5.4.2

  • Fixmd5(user['password']) weighs the same evidence
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.2

5.4.1

  • Docsdetect-non-literal-fs-filename records why its own safePattern looks like a false positive
  • Fixrequire-dependency-integrity renders a tagged template whole
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.1

5.4.0

  • Fixfive rules now see o['k'] as the same access as o.k
  • FixMIME, helmet, TLS and stream gates read a subscripted member
  • Fixtwenty-one Node rules read a member spelled with a string subscript
  • Fixfs['writeFileSync'](p, data) writes the same file as fs.writeFileSync
  • Fixcrypto, temp-storage and zip-slip gates read a subscripted method
  • Fixpresented['localeCompare'](stored) is the same non-constant-time compare
  • Fixbuffer, zlib and provenance gates resolve a subscripted member
  • Fixbuffer, AEAD and length-prefix gates read a subscripted method
  • Fixstats['isFile']() asks the same question of the same stat
  • Fixzlib['gunzip'](body, cb) is the same uncapped decompression
  • Fixchild_process['exec'](cmd) spawns the same shell
  • Fixmodule['require'](x) loads the same module
  • FixObject['assign'](process.env, req.body) is the same env injection
  • Fixtiming-compare, LDAP-adjacent and command gates read a subscripted member
  • FixTOCTOU roots, secure deletion and CSPRNG checks read a subscripted member
  • Fixan alias to Math.random is found through either spelling
  • Maintenancecrypto, fs and archive reads distinguish an unnameable key from an unknown one
  • Fixpath['basename'](userPath) sanitizes, and is no longer reported
  • Fixb['readUInt8'](0, true) reaches the bounds-check visitor
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

5.3.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

5.3.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • Feature🐛 Fix — no-ssrf reads a request by SHAPE, not by the name req
  • Feature🐛 Fix — no-ssrf identifies an HTTP client by its module, not its variable name
  • Feature✨ Feature — no-zip-slip gains archiveEntryFields
  • Fixno-unsafe-buffer-alloc has fixtures for the countNames option
  • Fix🐛 Fix — require-secure-credential-storage no longer reads configuration as a credential
  • Fixno-mutable-exports resolves bindings instead of grepping the file text
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

5.2.3

  • Fixno-timing-unsafe-compare reported AST discriminant comparisons.
  • Fixfive false positives found by scanning real repositories.
  • Fixno-improper-sanitization reported through a satisfies wrapper.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.3

5.2.2

  • FixTwo detections eslint-plugin-security has and we did not, plus a false positive in test files. #685
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

5.2.1

  • FixScaffolding for tests is now recognised as test material, and no-math-random-crypto allows test files by default. #671
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.1

5.2.0

  • no-weak-hash-algorithm sees twelve more spellings of "this is a credential". #659

5.1.3

  • Release notes now list every pull request in the release. #650
  • A visible origin beats a wire-shaped name. #654

5.1.2

  • Five false positives that would have shipped a false claim. #635
  • Four false positives found by scanning nineteen open-source repositories. #635
  • DependenciesUpdated internal dependencies

5.1.1

  • no-timing-unsafe-compare no longer treats a route as a credential. #589

5.1.0

  • detect-child-process no longer calls a shell-free spawn "command injection". #581
  • detect-non-literal-fs-filename now sees through a computed key. #583
  • detect-child-process no longer reads -c as an eval flag for every binary. #584

5.0.0

  • Remove schema options that were never read #574
  • Rules now say only what they proved #574
  • Rules decide by evidence, and every vocabulary is now an option #574
  • DependenciesUpdated internal dependencies

4.13.1

  • no-xpath-injection now needs evidence rather than names, and every rule carries a CVSS. #563
  • DependenciesUpdated internal dependencies

4.13.0

  • 100% drop-in parity with eslint-plugin-security, and twelve false-positive fixes. #560

4.12.0

  • Fix a command-injection false negative, repair every rule's documentation link, and close the #555
  • DependenciesUpdated internal dependencies

4.11.0

  • detect-non-literal-fs-filename now reports on reachable taint instead of on #546
  • detect-non-literal-fs-filename no longer reports paths that are fixed at #546
  • no-arbitrary-file-access now reports only paths it can attribute to a request, #546
  • DependenciesUpdated internal dependencies

4.10.0

  • no-weak-hash-algorithm: exempt hashes stored under a non-cryptographic name. #531
  • no-timing-unsafe-compare no longer reports comparisons against constants. #531

4.9.1

  • lock-file: report once per project, not once per file #500
  • detect-suspicious-dependencies: stop reporting real packages as typosquats #496
  • DependenciesUpdated internal dependencies

4.9.0

  • no-self-signed-certs is now part of the recommended preset. #461
  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • meta.hasSuggestions now matches what each rule actually emits. #309
  • Two more false-positive classes from the whole-ruleset sweep. #417
  • DependenciesUpdated internal dependencies

4.8.1

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

4.8.0

  • detect-non-literal-fs-filename now resolves the fs binding instead of matching #401
  • DependenciesUpdated internal dependencies

4.7.3

  • Document every rule option, and add description to the schemas that had none #383
  • Load rule modules on demand instead of at plugin load. #381
  • Declare what we support, load only what we use #381
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • DependenciesUpdated internal dependencies

4.7.2

  • Add the ecosystem and oxlint marks to the README logo row. Each plugin now #364

4.7.1

  • Re-publish every package so npm carries the optimised artifact #338
  • DependenciesUpdated internal dependencies

4.7.0

  • Eight new rules closing the two fixable gaps found by the F#24/F#26 coverage #313
  • DependenciesUpdated internal dependencies

4.6.0

  • New rule no-unsafe-buffer-alloc (CWE-908, Use of Uninitialized Resource) — #305
  • no-ssrf: recognise needle as an HTTP client, so needle.get(req.query.url) reports. The verb-first needle('get', url) form is still not covered — the rule only inspects the first argument. #317
  • DependenciesUpdated internal dependencies

4.5.0

  • Add no-timing-unsafe-compare to the recommended preset, restoring CWE-697 #310
  • Cut false positives in five security rules, measured against a 1,470-file corpus (webpack lib/, lodash, eslint-plugin-import src/, and two NestJS boilerplates). #288
  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • Cut two false positives confirmed against the benchmark corpus SAFE fixtures. #296
  • DependenciesUpdated internal dependencies

4.4.3

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

4.4.2

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

4.4.1

  • CI-only: pin all coverage thresholds at 100% (integration target, merges last). #225

4.4.0

  • Featurefeat(node-security): add no-dynamic-algorithm-selection (CWE-327) #190
  • Align no-dynamic-algorithm-selection's meta.docs.cvss (7.4) to the CVSS its #215
  • Align every security rule's meta.docs.cvss to the CVSS its finding actually #213

4.3.0

  • Featurefeat(node-security): add no-math-random-crypto (CWE-338) #148
  • Fixfix: ILB-Wild FP reduction + doc examples + doc-test-alignment scanner fixes #144
  • Fixfix: remove false meta.fixable: 'code' declarations from 21 rules that had no fix() function #141
  • Consolidation cleanup — no rule behavior change: #186
  • feat+fix: ILB-Wild FP reduction + two new quality rules #148
  • DependenciesUpdated internal dependencies

4.1.0

  • New rule no-deprecated-buffer — flags use of the deprecated Buffer() constructor (Node.js security advisory; Buffer.from/Buffer.alloc should be used instead). Enabled in the recommended preset at warn to avoid breaking adopters with legacy Buffer() calls; will be promoted to error in the next major.
  • no-zip-slip: removed redundant dangerous-destination check from the literal handler. Extraction-call handler already reports dangerousArchiveDestination; the literal-side check was producing duplicate errors and (separately) firing on unrelated calls like fs.readFileSync('/etc/app/config').
  • lock-file, detect-child-process: minor refinements (see source diff).

4.0.4

  • align codecov component IDs with full package names
  • resolve all benchmark FN/FP across security rules
  • rules: reduce false positives across security rules
  • fix changelog header format across all packages
  • Ofri Peretz

4.0.3

  • ⚠️ rules: reduce false positives across security rules
  • align codecov component names and update docs components
  • rules: Some previously flagged patterns are now correctly allowed
  • Ofri Peretz

4.0.2

  • 📘 Launched new documentation site: eslint.interlace.tools
  • 📝 Achieved 100% documentation parity (both .md and .mdx files)

1.0.0

  • Initial stable release with 31 Node.js security rules
  • LLM-optimized error messages with CWE references and OWASP mapping
  • 100% test coverage across all rules
  • ESLint 8 and ESLint 9 flat config support
  • TypeScript type definitions for all rule options
  • no-sha1-hash - Disallow SHA-1 for security-sensitive operations (CWE-328)
  • no-weak-hash-algorithm - Disallow MD5, SHA-1 for cryptographic hashing (CWE-328)
  • no-ecb-mode - Disallow ECB mode for block ciphers (CWE-327)
  • no-static-iv - Disallow static initialization vectors (CWE-329)
  • no-insecure-key-derivation - Require secure key derivation functions (CWE-916)
  • no-insecure-rsa-padding - Require OAEP padding for RSA (CWE-780)
  • no-self-signed-certs - Detect disabled TLS certificate validation (CWE-295)
  • no-timing-unsafe-compare - Require timing-safe comparison for secrets (CWE-208)
  • no-cryptojs - Prefer native crypto over CryptoJS (CWE-327)
  • no-cryptojs-weak-random - Disallow CryptoJS weak random (CWE-338)
  • no-deprecated-cipher-method - Disallow deprecated crypto methods (CWE-327)
  • prefer-native-crypto - Prefer Node.js native crypto module
  • no-path-traversal - Prevent path traversal attacks (CWE-22)
  • no-unsafe-file-permissions - Enforce secure file permissions (CWE-732)
  • no-symlink-attacks - Prevent symlink-based attacks (CWE-59)
  • require-file-validation - Require file type validation (CWE-434)
  • no-temp-file-exposure - Prevent temp file security issues (CWE-377)
  • no-hardcoded-paths - Prevent hardcoded sensitive paths (CWE-426)
  • require-safe-path-join - Require path.join for path construction (CWE-22)
  • no-child-process-injection - Prevent command injection (CWE-78)
  • no-shell-exec - Disallow shell: true in spawn options (CWE-78)
  • no-env-exposure - Prevent environment variable exposure (CWE-214)
  • require-process-sanitization - Require input sanitization for process args (CWE-88)
  • no-unsafe-exec - Disallow exec with dynamic input (CWE-78)
  • no-eval-alternatives - Disallow Function constructor, vm runInContext (CWE-95)
  • require-tls-verification - Require TLS certificate validation (CWE-295)
  • no-dns-rebinding - Prevent DNS rebinding attacks (CWE-350)
  • no-ssrf - Prevent Server-Side Request Forgery (CWE-918)
  • require-https - Require HTTPS for external requests (CWE-319)
  • no-unsafe-redirect - Prevent open redirects (CWE-601)
  • require-host-validation - Require host header validation (CWE-20)
  • recommended - Balanced security for Node.js applications
  • strict - All rules as errors
  • crypto - Cryptography-focused subset
  • filesystem - File system security subset
  • network - Network security subset
  • Comprehensive detection patterns for Node.js core modules
  • Support for popular libraries (fs-extra, glob, rimraf)
  • Auto-fix capabilities where safe
  • ESLint MCP integration for AI assistants

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-node-security

Node.js security rules for fs, child_process, vm, and crypto modules

Rules

All ESLint security rules provided by eslint-plugin-node-security