
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@homebound/eslint-config
Advanced tools
Attempts to be a 1-Stop Shop for all of Homebound's code formatting needs. This includes ESLint, Lint Configs, and Prettier setup. This README also contains recommendations for IDE configuration.
yarn add -D eslint @homebound/eslint-config
eslint.config.mjsWe expose several configs based on the project type.
default - The default config that all projects should extend.react - The config for React projects.joist - The config for Joist projects. This assumes you're using Joist and node-pg-migrate for migrations.graphql - The config for GraphQL projects.To start, create a eslint.config.mjs file in the root of your project with the following content:
import homeboundConfig from "@homebound/eslint-config";
export default [
...homeboundConfig,
];
Then, for each additional config that matches your project, import it and add apply the rules to the config.
import homeboundConfig from "@homebound/eslint-config";
import homeboundGraphqlConfig from "@homebound/eslint-config/graphql.mjs";
import homeboundJoistConfig from "@homebound/eslint-config/joist.mjs";
import homeboundReactConfig from "@homebound/eslint-config/react.mjs";
export default [
...homeboundConfig,
...homeboundGraphqlConfig,
...homeboundJoistConfig,
...homeboundReactConfig,
];
Next, add the following scripts to your package.json, assuming your code lives in a src/ directory:
{
"scripts": {
"lint": "eslint",
"lint:fix": "eslint --fix"
}
}
It's advised to add a Linting step to your pipeline that will enforce errors. --quiet can be used to suppress warnings
so only errors are reported. For CircleCI, add a run step such as this example:
jobs:
tests:
...
steps:
...
- run: yarn lint --quiet
...
Finally it is recommended to lean into your IDE's tooling to work with ESLint to enforce consistent styling for a
project across your team. For example, with VSCode,
ESLint should be installed, then
Added to Recommended Workspace Extensions via .vscode/extensions.json, and finally the Project should be
configured to use ESLint to Format-on-Save:
// .vscode/settings.json
{
"eslint.format.enable": true,
"editor.defaultFormatter": "dbaeumer.vscode-eslint",
"editor.formatOnSave": true
}
You may choose to look in to Husky and lint-staged
Using a .editorconfig is also recommended, along with the associated plugins (Often included by default such as in
Jetbrains tooling)
If using the ESLint plugin, it must be instructed to lint GraphQL files. Additionally, the top-level
editor.defaultFormatter wasn't enough to tell VSCode to lint GraphQL files, so that must be updated as well. In
.vscode/settings.json, add:
"eslint.validate": [
"javascript",
"javascriptreact",
"typescript",
"typescriptreact",
"html",
"vue",
"markdown",
"graphql"
],
"[graphql]": {
"editor.defaultFormatter": "dbaeumer.vscode-eslint"
}
Keep in mind that "plugins" simply provide rules that may be used. "configs" are a collection of rules that are set up to critique our codebase and those are what we "extend" in our ESLint configs.
We maintain a Style Guide on Confluence which this project will (one day) attempt to align with as much as possible. For now, no attempt has been made to sync the two, but ideally that will change.
To test this config locally against a project, first run yarn link in this project, then cd into the target
project and run yarn link @homebound/eslint-config. Changes you make in here should reflect immediately in that
project. For example, if you switch a warn to an error in one of the configs then yarn lint in that project, you
should see the errors immediately.
To unlink, run yarn unlink @homebound/eslint-config and then run yarn install to revert to the published version.
FAQs
Portable eslint-config for Homebound projects
We found that @homebound/eslint-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 37 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.