
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@springernature/eslint-config
Advanced tools
Shareable ESLint config used at Springer Nature for enforcing consistent code style across JavaScript files.
ESLint statically analyzes your code to quickly find problems. It is built into most text editors and you can run ESLint as part of your continuous integration pipeline.
[!IMPORTANT]
As of version7.0.0
of this configuration all code format rules have been removed, and you should be using this in conjunction with our prettier configuration.
This package requires:
eslint@^9.32.0
@eslint/js@^9.32.0
eslint-plugin-import@^2.32.0
eslint-plugin-no-use-extend-native@^0.7.2
eslint-plugin-promise@^7.2.1
eslint-plugin-unicorn@^59.0.1
globals@^16.3.0
eslint-plugin-jest@^28.11.0
(jest config only)eslint-plugin-n@^17.21.3
(node config only)eslint-plugin-security@^3.0.1
(node config only)Our default export contains all of our ESLint rules.
eslint
is defined in peerDependencies
, which means that you will need to add these to your own project's devDependencies
.
Install our config and all it's required dependencies to your devDependencies
with the following command:
npm install -D eslint@^9.32.0 @eslint/js@^9.32.0 eslint-plugin-import@^2.32.0 eslint-plugin-no-use-extend-native@^0.7.2 eslint-plugin-promise@^7.2.1 eslint-plugin-unicorn@^59.0.1 globals@^16.3.0 @springernature/eslint-config
If configuring for jest, you can add the additional dependency to your devDependencies
with the following command:
npm install -D eslint-plugin-jest@^28.11.0
If configuring for node, you can add the additional dependencies to your devDependencies
with the following command:
npm install -D eslint-plugin-n@^17.21.3 eslint-plugin-security@^3.0.1
You then need to setup the configuration so it can be used in your project.
eslint.config.js
file in the root of your project.core
configuration as in the example below. All implementations must use this as a minimum.import {coreConfig} from '@springernature/eslint-config';
import {defineConfig} from "eslint/config";
export default defineConfig([
{
files: ["**/*.js"],
extends: [coreConfig],
rules: {
// custom rules
},
},
]);
browser
- For browser environmentsnode
- Add if your project contains Node.jsjest
- Add if your project uses JestImport the configuration(s) your need for your project, and then add the configuration map(s) to the exported array.
import {coreConfig, nodeConfig, browserConfig, jestConfig} from '@springernature/eslint-config';
import {defineConfig} from "eslint/config";
import globals from 'globals';
export default defineConfig([
{
files: ["**/*.js"],
languageOptions: {
globals: {...globals.node, ...globals.browser}
},
extends: [coreConfig],
rules: {
// custom rules
},
},
{
files: ["server/**/*.js", "cli/**/*.js"],
extends: [nodeConfig],
rules: {
// custom rules
},
},
{
files: ["lib/frontend/**/*.js"],
extends: [browserConfig],
rules: {
// custom rules
},
},
{
files: ["**/*(spec|test).js"],
extends: [jestConfig]
}
]);
The behaviour of some rules (specifically no-deprecated-functions) change depending on the version of Jest being used.
By default, this plugin will attempt to locate Jest using require.resolve, meaning it will start looking in the closest node_modules
folder to the file being linted and work its way up.
Since we cache the automatically determined version, if you're linting sub-folders that have different versions of Jest, you may find that the wrong version of Jest is considered when linting. You can work around this by providing the Jest version explicitly in nested ESLint configs:
{
"settings": {
"jest": {
"version": 27
}
}
}
To avoid hard-coding a number, you can also fetch it from the installed version of Jest in your eslint.config.js
file:
module.exports = {
settings: {
jest: {
version: require('jest/package.json').version,
},
},
};
There are several ways that ESLint can be used, however, it is recommended to run it from within your code editor.
Visual code, for example, has an eslint-vscode plugin.
If you don't already use ESLint, it is likely that you will want to run it against your whole project, and then use the editor to maintain it's usage as you make code changes.
To do this, you can run:
npx eslint
This will format all matching files according to the ESLint configuration. This could result in a large number of stylistic changes to the code, mostly from changing quote style, adding spaces around braces, etc. If you want to start using ESLint more incrementally, you can instruct it to ignore code.
Often you will want to ignore certain files or folders from being formatted. For example, compiled code or test coverage folders.
You can do this by adding an ignores
property in your eslint.config.js
file.
// eslint.config.js
export default [
{
ignores: [".config/*"]
}
];
This package is used by many active Springer Nature projects. We always welcome issues and pull requests, but we may not always be able to merge your suggestions.
If we decide that we can't merge your PR or act on your issue, it's nothing personal! We love to see new contributors, and we strive to provide a welcoming and inclusive environment.
The eslint-config-springernature repository is licensed under the MIT License.
All packages within this repository are licensed under the MIT License.
Copyright © 2025, Springer Nature
FAQs
Springernature shareable config for ESLint
We found that @springernature/eslint-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 17 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.