
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@app-press/eslint-config
Advanced tools
This package provides App Press' .eslintrc.json as an extensible shared config.
A few ESLint configurations are exported for convenience; all exports allow for standard testing frameworks (Mocha, Jasmine, and Jest):
The default export contains all ESLint rules, including ES6 and React, and tries to find a balance between traditional server-side and client-side code styles. For this reason, it does not use modules for client-side code by default; thus, the following code will not pass linting:
import React from "react";
But this will:
const React = require("react");
npm install --save-dev @app-press/eslint-config eslint eslint-plugin-react
"extends": "@app-press/eslint-config
to your .eslintrc fileThis export is for use on server-side-only code and will not lint React (though it will lint ES6).
npm install --save-dev @app-press/eslint-config eslint
"extends": "@app-press/eslint-config/node
to your .eslintrc.json fileThis export is for use on client-side-only code and will lint React (including JSX) and ES6 code.
npm install --save-dev @app-press/eslint-config eslint
"extends": "@app-press/eslint-config/client
to your .eslintrc fileThis export is for use on client-side-only code and will lint React (including JSX) and ES6 code. It will also expect that all client-side code is ES6 module based (and thus will assume strict by default).
npm install --save-dev @app-press/eslint-config eslint
"extends": "@app-press/eslint-config/client-modules
to your .eslintrc fileTo override specific rules, simply add a rules
section to your .elintrc.json and add your desired rules — they will take precedence.
You may also modify the parser, parserOptions, etc. Just include those sections as well.
FAQs
App Press' ESLint rules
We found that @app-press/eslint-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.