
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@fedify/lint
Advanced tools
This package is available since Fedify 2.0.0.
This package provides Deno Lint and ESLint plugin with lint rules specifically designed for Fedify applications. It helps you catch common mistakes and enforce best practices when building federated server apps with Fedify.
The plugin includes rules that check for:
// deno.json
{
"lint": {
"plugins": {
"@fedify/lint": "jsr:@fedify/lint"
},
"rules": {
"@fedify/lint/actor-id-required": "error",
"@fedify/lint/actor-id-mismatch": "error",
"@fedify/lint/actor-inbox-property-required": "warn"
// ... other rules
}
}
}
// eslint.config.ts
import fedifyLint from "@fedify/lint";
export default fedifyLint;
The @fedify/lint package provides comprehensive linting rules for Fedify
federation code:
actor-id-required: Ensures all actors have an id propertyactor-id-mismatch: Validates that actor IDs match the expected URI
from Context.getActorUri()actor-public-key-required: Ensures actors have public keys for
HTTP Signaturesactor-assertion-method-required: Validates assertion methods for
Object Integrity Proofsactor-inbox-property-required: Ensures inbox is defined when
setInboxListeners is setactor-inbox-property-mismatch: Validates inbox URI from getInboxUriactor-outbox-property-required: Ensures outbox is defined when
setOutboxDispatcher is setactor-outbox-property-mismatch: Validates outbox URI from
getOutboxUriactor-followers-property-required: Ensures followers is defined when
setFollowersDispatcher is setactor-followers-property-mismatch: Validates followers URI from
getFollowersUriactor-following-property-required: Ensures following is defined when
setFollowingDispatcher is setactor-following-property-mismatch: Validates following URI from
getFollowingUriactor-liked-property-required: Ensures liked is defined when
setLikedDispatcher is setactor-liked-property-mismatch: Validates liked URI from getLikedUriactor-featured-property-required: Ensures featured is defined when
setFeaturedDispatcher is setactor-featured-property-mismatch: Validates featured URI from
getFeaturedUriactor-featured-tags-property-required: Ensures featuredTags is defined
when setFeaturedTagsDispatcher is setactor-featured-tags-property-mismatch: Validates featuredTags URI from
getFeaturedTagsUriactor-shared-inbox-property-required: Ensures sharedInbox is defined
when setInboxListeners is setactor-shared-inbox-property-mismatch: Validates sharedInbox URI from
getInboxUricollection-filtering-not-implemented: Warns about missing collection
filtering implementation (setFollowersDispatcher only for now)::: code-group
deno add jsr:@fedify/lint
npm add -D @fedify/lint
pnpm add -D @fedify/lint
yarn add -D @fedify/lint
bun add -D @fedify/lint
:::
Add the plugin to your deno.json configuration file:
{
"lint": {
"plugins": ["jsr:@fedify/lint"]
}
}
By default, this enables all recommended rules.
You can customize which rules to enable and their severity levels:
{
"lint": {
"plugins": ["jsr:@fedify/lint"],
"rules": {
"tags": ["recommended"],
"include": [
"@fedify/lint/actor-id-required",
"@fedify/lint/actor-id-mismatch"
],
"exclude": [
"@fedify/lint/actor-featured-property-required"
]
}
}
}
After setting up the configuration, run Deno's linter:
deno lint
You can also specify which files to lint:
deno lint federation.ts
deno lint src/federation/
Add the plugin to your ESLint configuration file (e.g., eslint.config.ts or eslint.config.js):
import fedifyLint from "@fedify/lint";
// If your `createFederation` code is in `federation.ts` or `federation/**.ts`
export default fedifyLint;
// Or specify your own federation files
export default {
...fedifyLint,
files: ["my-own-federation.ts"],
};
// If you use other ESLint configurations
export default [
otherConfig,
fedifyLint,
];
The default configuration applies recommended rules to files that match common federation-related patterns (e.g., federation.ts, federation/*.ts).
You can customize which files to lint and which rules to enable:
import { plugin } from "@fedify/lint";
export default [{
files: ["src/federation/**/*.ts"], // Your federation code location
plugins: {
"@fedify/lint": plugin,
},
rules: {
"@fedify/lint/actor-id-required": "error",
"@fedify/lint/actor-id-mismatch": "error",
"@fedify/lint/actor-inbox-property-required": "warn",
// ... other rules
},
}];
The plugin provides two preset configurations:
Enables critical rules as errors and optional rules as warnings:
import fedifyLint from "@fedify/lint";
export default fedifyLint;
Enables all rules as errors:
import { plugin } from "@fedify/lint";
export default [{
files: ["**/*.ts"],
...plugin.configs.strict,
}];
Here's an example of code that would trigger lint errors:
// ❌ Wrong: Using relative URL for actor ID
import { createFederation, Person } from "@fedify/fedify";
const federation = createFederation({ /* ... */ });
federation.setActorDispatcher(
"/{identifier}",
(_ctx, identifier) => {
return new Person({
id: new URL(`/${identifier}`), // ❌ Should use ctx.getActorUri()
name: "Example User",
});
},
);
Corrected version:
// ✅ Correct: Using Context.getActorUri() for actor ID
import { createFederation, Person } from "@fedify/fedify";
const federation = createFederation({ /* ... */ });
federation.setActorDispatcher(
"/{identifier}",
(ctx, identifier) => {
return new Person({
id: ctx.getActorUri(identifier), // ✅ Correct
name: "Example User",
inbox: ctx.getInboxUri(identifier),
outbox: ctx.getOutboxUri(identifier),
followers: ctx.getFollowersUri(identifier),
// ... other required properties
});
},
);
Run Deno's linter with the plugin enabled:
deno lint
You can also specify which files or directories to lint:
deno lint federation.ts
deno lint src/federation/
Set up your ESLint configuration as shown above and add a follwing script on
package.json:
{
"scripts": {
"lint": "eslint ."
}
}
After setting up the configuration, run ESLint on your codebase:
::: code-group
npm run lint
pnpm lint
yarn lint
bun lint
:::
or run the linter directly via command line:
::: code-group
npx eslint .
pnpx eslint .
yarn eslint .
bunx eslint .
:::
FAQs
Fedify linting rules and plugins
The npm package @fedify/lint receives a total of 1,881 weekly downloads. As such, @fedify/lint popularity was classified as popular.
We found that @fedify/lint demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.