
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@mizdra/eslint-interactive
Advanced tools
The CLI tool to run eslint --fix
for each rule
The default ESLint output contains a lot of useful information for developers, such as the source of the error and hints for fixing it. While this works for many use cases, it does not work well in situations where many errors are reported. For example, when introducing ESLint into a project, or when making big changes to the .eslintrc
of a project. In these situations, the output of ESLint can be quite large, making it difficult for developers to analyze the output. It is also difficult for the developer to fix errors because many types of errors are mixed up in the output.
In such an error-prone situation, I think two things are important:
eslint --fix
is one of the best ways to fix errors efficiently, but it auto-fixes all rule errors at once.eslint --fix
.So, I created a tool called eslint-interactive
which wraps ESLint. This tool groups all errors by rule and outputs the number of errors per rule in a formatted format. In addition to the breakdown of warnings and errors per rule, it also outputs the number of fixable errors and other hints to help developers fix errors. You can also specify a number of rules to display raw ESLint error messages or to auto-fix.
A tool similar to eslint-interactive
is eslint-nibble. Both tools solve the same problem, but eslint-interactive
has some features that eslint-nibble
does not have. For example, eslint-interactive
prints the number of fixable errors per rule, while eslint-nibble
does not. Also, eslint-interactive
has various tricks to speed up the cycle of auto-fixing per-rule, but eslint-nibble
auto-fixes once and terminates the process every time, so it is not as fast as eslint- interactive
.
I think these features are very important to solve the aforementioned problem. At first, I thought of implementing these features in eslint-nibble
, but it required a major rewrite of the code, so I implemented it as a new tool eslint-interactive
. Although eslint-interactive
is a tool independent of eslint-nibble
, it is influenced by the ideas of eslint-nibble
and inherits some of its code. That's why you can find the names of @IanVS and others in the license of eslint-interactive
.
Thanks, @IanVS.
$ npm i -g eslint @mizdra/eslint-interactive
$ eslint-interactive --help
$ # or npx
$ npx -p eslint -p @mizdra/eslint-interactive eslint-interactive --help
$ # Show help
$ eslint-interactive --help
eslint-interactive [file.js] [dir]
Options:
--help Show help [boolean]
--version Show version number [boolean]
--ruledir Use additional rules from this directory [array]
--ext Specify JavaScript file extensions [array]
$ # Examples
$ eslint-interactive ./src
$ eslint-interactive ./src ./test
$ eslint-interactive './src/**/*.{ts,tsx,vue}'
$ eslint-interactive ./src --ext .ts,.tsx,.vue
$ eslint-interactive ./src --ruledir ./rules
--no-pager
optionyarn run build
: Build for productionyarn run dev
: Run for developmentyarn run check
: Try static-checkingyarn run test
: Run tests$ # Wait for passing CI...
$ git switch master
$ git pull
$ yarn version
$ rm -rf dist && yarn run build
$ npm publish
$ git push --follow-tags
FAQs
The CLI tool to run `eslint --fix` for each rule
We found that @mizdra/eslint-interactive demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.