eslint-plugin-sequelize-security

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Security rules for the Sequelize ORM (SQL injection prevention in raw queries).

Why Sequelize-specific?

An ORM is not a defence against SQL injection — it narrows the surface to the raw escapes, and those are still string-built. Sequelize has two: sequelize.query() and Sequelize.literal(). OWASP Juice Shop's two flagship injections are both the former, and neither was reported by any recommended preset in this ecosystem until this plugin existed — the only implementation of the detection shipped inside eslint-plugin-postgresql-security, which no Sequelize user installs.

Being Sequelize-specific is what makes the rule precise. It knows the safe conventions to stay quiet on (replacements, bind), and it knows literal() is a SQL sink rather than an ordinary helper — so it catches ORDER BY injection that a generic string-concatenation linter has no reason to flag. It also tracks variable taint across statements, so const sql = "SELECT..." + id; sequelize.query(sql) reports even with the concatenation on a separate line.

• Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
• How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
• What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-sequelize-security --save-dev

⚙️ Configuration Presets

📚 Supported Libraries

Library	npm	Downloads	Detection
sequelize			SQL Injection

Sequelize runs on Postgres, MySQL, MariaDB, SQLite, MSSQL and Snowflake — this plugin fires on the raw-SQL escapes regardless of which dialect is configured.

Custom Configuration

import sequelize from 'eslint-plugin-sequelize-security';

export default [
  {
    plugins: { 'sequelize-security': sequelizeSecurity },
    rules: {
      'sequelize-security/no-unsafe-query': 'error',
    },
  },
];

💡 What You Get

• Covers the escapes your ORM leaves open: sequelize.query() and Sequelize.literal(), the two places raw SQL still gets built by hand
• Sequelize's own remediation: every finding names replacements / bind, not a generic "use parameterized queries"
• Cross-statement taint tracking: catches queries assembled over several lines, including with +=
• Quiet on safe code: parameterized queries, static SQL and builder calls do not report
• LLM-optimized messages: structured 2-line errors with CWE + fixes that AI assistants can apply

Every rule produces a structured error message:

routes/search.ts
  23:24  error  🔒 CWE-89 OWASP:A03-Injection CVSS:9.8 | Unsafe SQL query construction detected (template literal) | CRITICAL
                    Fix: Pass values via `replacements` or `bind` instead of interpolating them into the SQL string.

📦 Compatibility

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
eslint-plugin-anthropic-security		Anthropic SDK security.
eslint-plugin-browser-security		XSS, DOM security.
eslint-plugin-drizzle-security		Drizzle security.
eslint-plugin-express-security		Express middleware hardening.
eslint-plugin-gemini-security		Google Gemini SDK security.
eslint-plugin-jwt-security		Token security.
eslint-plugin-knex-security		Knex security.
eslint-plugin-lambda-security		AWS Lambda hardening.
eslint-plugin-mcp-sdk-security		MCP SDK security.
eslint-plugin-mongodb-security		MongoDB injection.
eslint-plugin-mysql-security		MySQL security.
eslint-plugin-nestjs-security		NestJS framework hardening.
eslint-plugin-node-security		Server-side patterns.
eslint-plugin-openai-security		OpenAI SDK security.
eslint-plugin-postgresql-security		PostgreSQL security.
eslint-plugin-prisma-security		Prisma security.
eslint-plugin-secure-coding		Injection prevention.
eslint-plugin-sqlite-security		SQLite security.
eslint-plugin-supabase-security		Supabase security.
eslint-plugin-typeorm-security		TypeORM security.
eslint-plugin-vercel-ai-security		AI SDK security.

Code quality

Plugin	Downloads	Description
eslint-plugin-conventions		Team-specific habits and styles.
eslint-plugin-import-next		Fast cycle + import-graph analysis.
eslint-plugin-maintainability		Cognitive load and clean-code patterns.
eslint-plugin-modernization		ESNext migration + syntax evolution.
eslint-plugin-modularity		Structural integrity and DDD patterns.
eslint-plugin-operability		Production readiness and resource health.
eslint-plugin-react-a11y		React accessibility / WCAG.
eslint-plugin-react-features		React best practices and optimization.
eslint-plugin-reliability		Runtime stability and error safety.

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz