Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@build-chores/eslint-config-lint
Advanced tools
@build-chores/eslint-config-lint
Linting JS projects is complicated.
Lint your JavaScript code. This config is based on Airbnb's base lint configuration and includes support for Prettier, the Flow type checker and promises.
Install the @build-chores/eslint-config-lint
package into your project:
yarn install --dev @build-chores/eslint-config-lint
Create a .eslintrc
file containing the following snippet. See the example .eslintrc
for a template.
{
"extends": ["@build-chores/lint"]
}
To use flow as well place a .flowconfig
and .flowcoverage
configuration file. See the example flowconfig
and the example .flowcoverage
for templates.
Note that even if flow
isn't use an empty .flowconfig
file has to be created.
This package installs flow-typed
to install flow type definitions. To make it work in this setup the flow-libdefs
wrapper script is provided. It takes the same arguments as flow-typed
.
The following command installs type definitions for your dependencies.
yarn flow-libdefs install
Edit your package.json
to include the following scripts. See the example package.json
for a template.
{
"scripts": {
"fix": "yarn lint --fix",
"flow:coverage": "yarn flow-coverage-report --config ./.flowcoverage",
"flow:gen": "gen-flow-files --out-dir dist src",
"flow:libdefs": "yarn flow-libdefs update",
"lint": "eslint src/**/*.js**"
}
}
Types are checked during the regular linting. If you want to run Flow separated, you can call the flow
command directly with yarn flow
.
See the rules file for details of the ESLint configuration.
You are ready to lint your JavaScript code.
Check out our contributing.md to get started.
FAQs
Linting JS projects is complicated.
We found that @build-chores/eslint-config-lint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.