
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@mkvlrn/eslint-config-javascript-react
Advanced tools
Eslint configurations for react JavaScript projects based on airbnb's guide
this package mainly extends airbnb's excellent guide, disabling a few rules in order to accommodate the projects i usually create
also includes a default jest config
convenience - not having to juggle packages left and right before using eslint is a far away dream, but we can hack it today
install-peerdeps will install all peer dependencies as dev dependencies if needed
# install-peerdeps using yarn
npx install-peerdeps @mkvlrn/eslint-config-javascript-react -Y -D
# install-peerdeps using npm
npx install-peerdeps @mkvlrn/eslint-config-javascript-react -D
yarn add @mkvlrn/eslint-config-javascript-react \
@babel/core \
@babel/eslint-parser \
@babel/preset-env \
eslint \
eslint-config-airbnb \
eslint-config-prettier \
eslint-plugin-import \
eslint-plugin-jest \
eslint-plugin-jsx-a11y \
eslint-plugin-react \
eslint-plugin-react-hooks -D
// .eslintrc.json, .eslintrc
// this extends the default config
{
"extends": ["@mkvlrn/eslint-config-javascript-react"]
}
this rule just makes it awkward to deal with mongodb models (which have a _id field by default)
this rule spoils tree-shaking (in some projects) and marks the exporting of cloud functions that require a named export as incorrect
react's new jsx transform doesn't expect React to be in scope when using jsx, and these rules expect it to be imported
FAQs
Eslint configurations for react JavaScript projects based on airbnb's guide
We found that @mkvlrn/eslint-config-javascript-react demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.