Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@mizdra/eslint-interactive
Advanced tools
The CLI tool to run eslint --fix
for each rule
The default ESLint output contains a lot of useful information for developers, such as the source of the error and hints for fixing it. While this works for many use cases, it does not work well in situations where many errors are reported. For example, when introducing ESLint into a project, or when making big changes to the .eslintrc
of a project. In these situations, the output of ESLint can be quite large, making it difficult for developers to analyze the output. It is also difficult for the developer to fix errors because many types of errors are mixed up in the output.
In such an error-prone situation, I think two things are important:
eslint --fix
is one of the best ways to fix errors efficiently, but it auto-fixes all rule errors at once.eslint --fix
.So, I created a tool called eslint-interactive
which wraps ESLint. This tool groups all errors by rule and outputs the number of errors per rule in a formatted format. In addition to the breakdown of warnings and errors per rule, it also outputs the number of fixable errors and other hints to help developers fix errors. You can also specify a number of rules to display raw ESLint error messages or to auto-fix.
A tool similar to eslint-interactive
is eslint-nibble. Both tools solve the same problem, but eslint-interactive
has some features that eslint-nibble
does not have. For example, eslint-interactive
prints the number of fixable errors per rule, while eslint-nibble
does not. Also, eslint-interactive
has various tricks to speed up the cycle of auto-fixing per-rule, but eslint-nibble
auto-fixes once and terminates the process every time, so it is not as fast as eslint- interactive
.
I think these features are very important to solve the aforementioned problem. At first, I thought of implementing these features in eslint-nibble
, but it required a major rewrite of the code, so I implemented it as a new tool eslint-interactive
. Although eslint-interactive
is a tool independent of eslint-nibble
, it is influenced by the ideas of eslint-nibble
and inherits some of its code. That's why you can find the names of @IanVS and others in the license of eslint-interactive
.
Thanks, @IanVS.
$ npm i -g eslint @mizdra/eslint-interactive
$ eslint-interactive --help
$ # or npx
$ npx -p eslint -p @mizdra/eslint-interactive eslint-interactive --help
$ # Show help
$ eslint-interactive --help
eslint-interactive [file.js] [dir]
Options:
--help Show help [boolean]
--version Show version number [boolean]
--ruledir Use additional rules from this directory [array]
--ext Specify JavaScript file extensions [array]
$ # Examples
$ eslint-interactive ./src
$ eslint-interactive ./src ./test
$ eslint-interactive './src/**/*.{ts,tsx,vue}'
$ eslint-interactive ./src --ext .ts,.tsx,.vue
$ eslint-interactive ./src --ruledir ./rules
--no-pager
optionyarn run build
: Build for productionyarn run dev
: Run for developmentyarn run check
: Try static-checkingyarn run test
: Run tests$ # Wait for passing CI...
$ git switch master
$ git pull
$ yarn version
$ rm -rf dist && yarn run build
$ npm publish
$ git push --follow-tags
FAQs
The CLI tool to run `eslint --fix` for each rule
The npm package @mizdra/eslint-interactive receives a total of 0 weekly downloads. As such, @mizdra/eslint-interactive popularity was classified as not popular.
We found that @mizdra/eslint-interactive demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.