
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@sheplu/eslint-config-json
Advanced tools
Opinionated ESLint rules and config for consistent, high-quality JSON with zero setup.
Opinionated, exhaustive configuration for @eslint/json — ready to drop into an ESLint 10+ flat config for JSON, JSONC, and JSON5 files.
Every non-deprecated upstream rule is configured explicitly, so nothing is left to defaults and nothing silently changes when @eslint/json ships a new rule — a scheduled CI job diffs the package against the upstream rule index every week and opens an issue on drift.
npm install --save-dev @sheplu/eslint-config-json eslint @eslint/json
Requires eslint >= 10 (flat config), @eslint/json >= 1, and Node >= 24.
Drop-in configs for each language variant (defaultJsonConfig, defaultJsoncConfig, defaultJson5Config) wire the plugin, the language, and the rules in one object:
import { defineConfig } from 'eslint/config';
import {
defaultJsonConfig,
defaultJsoncConfig,
defaultJson5Config,
} from '@sheplu/eslint-config-json';
export default defineConfig([
defaultJsonConfig,
defaultJsoncConfig,
defaultJson5Config,
]);
Or use jsonRules on its own if you want to supply your own files glob, plugins, or language:
import { defineConfig } from 'eslint/config';
import { jsonRules } from '@sheplu/eslint-config-json';
import json from '@eslint/json';
export default defineConfig([
{
files: [ '**/*.json' ],
plugins: { json },
language: 'json/json',
extends: [ jsonRules ],
},
]);
| Export | Type | Purpose |
|---|---|---|
jsonRules | Linter.Config[] | Rule bundle only — bring your own files/plugins/language. |
defaultJsonConfig | Linter.Config | Ready-to-use flat-config for **/*.json (json/json). |
defaultJsoncConfig | Linter.Config | Ready-to-use flat-config for **/*.jsonc (json/jsonc). |
defaultJson5Config | Linter.Config | Ready-to-use flat-config for **/*.json5 (json/json5). |
Every rule is set to error with options spelled out explicitly. If you need a more permissive baseline, override rules individually in your own config.
VS Code with the ESLint extension enabled. Add this to your .vscode/settings.json:
{
"editor.formatOnSave": true,
"eslint.validate": [ "json", "jsonc", "json5" ]
}
npm test # run the test suite (includes upstream drift check)
npm run test:coverage # run tests with coverage
npm run lint # lint the package itself
npm run lint:fix # lint with autofix
npm run setup:hooks # wire .githooks/ as the git hooks path (run once)
test/review-rules.js fetches the eslint/json rule docs index via the GitHub contents API and diffs it against the configured rule set. This runs:
npm test,.github/workflows/eslint-rules-drift.yaml), which opens a GitHub issue if new rules appear, are renamed, or are removed upstream.See AGENTS.md for the short version of how this repo is laid out and the CI quality gates. A few things worth knowing up front:
.githooks/. Run npm run setup:hooks once after cloning to point core.hooksPath there. The pre-commit hook runs lint and tests; the pre-push hook adds coverage and npm audit, and blocks direct pushes to main. (Hooks are opt-in because .npmrc sets ignore-scripts=true for supply-chain safety.)apkg rather than committed. apkg.json and apkg-lock.json are in the repo; the resolved files under .codex/, .claude/, .cursor/, etc. are gitignored and materialized by running apkg install. CI does this automatically in quality-gates.yaml. If you contribute using an AI agent and want those rule files locally, install apkg and run it against this repo.FAQs
Opinionated ESLint rules and config for consistent, high-quality JSON with zero setup.
We found that @sheplu/eslint-config-json demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.