Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@springernature/eslint-config
Advanced tools
ESLint shareable config used at Springer Nature.
Our default export contains all of our ESLint rules, and includes the following plugins:
eslint-plugin-import
(core)eslint-plugin-promise
(core)eslint-plugin-unicorn
(core)eslint-plugin-no-use-extend-native
(core & legacy)eslint-plugin-node
(optional)eslint-plugin-jest
(optional)npm info "@springernature/eslint-config@latest" peerDependencies
to list the peer dependencies and versionsyarn add --dev <dependency>@<version>
for each listed peer dependencyIf you have npx
available then you can run npx install-peerdeps --dev @springernature/eslint-config
to install the dependencies automatically. This will detect and use Yarn if available.
Install the correct versions of each package, which are listed by the command:
npm info "@springernature/eslint-config@latest" peerDependencies
If using npm 5+, you have NPX
available, and can use this shortcut
npx install-peerdeps --dev @springernature/eslint-config
If using npm < 5, Linux/OSX users can run
(
export PKG=@springernature/eslint-config;
npm info "$PKG@latest" peerDependencies --json | command sed 's/[\{\},]//g ; s/: /@/g' | xargs npm install --save-dev "$PKG@latest"
)
Which produces and runs a command like:
npm install --save-dev @springernature/eslint-config eslint@^#.#.# eslint-plugin-node@^#.#.# eslint-plugin-import@^#.#.# eslint-plugin-o-use-extend-native@^#.#.# eslint-plugin-promise@^#.#.# eslint-plugin-unicorn@^#.#.#
If using npm < 5, Windows users can either install all the peer dependencies manually, or use the install-peerdeps cli tool.
npm install -g install-peerdeps
install-peerdeps --dev @springernature/eslint-config
The cli will produce and run a command like:
npm install --save-dev @springernature/eslint-config eslint@^#.#.# eslint-plugin-node@^#.#.# eslint-plugin-import@^#.#.# eslint-plugin-o-use-extend-native@^#.#.# eslint-plugin-promise@^#.#.# eslint-plugin-unicorn@^#.#.#
Add one of the following to your .eslintrc
file:
core
- The core Springer Nature code style (with ES6 support)legacy
- For legacy JS environments (without ES6 support)These optional extensions can be added in addition to one of the above configurations:
// Core configuration
{
"extends": "@springernature/eslint-config",
"rules": {
// Additional, per-project rules...
}
}
// Legacy configuration
{
"extends": "@springernature/eslint-config/legacy",
"rules": {
// Additional, per-project rules...
}
}
// Optional extensions
{
"extends": [
"@springernature/eslint-config",
"@springernature/eslint-config/node",
"@springernature/eslint-config/jest"
],
"rules": {
// Additional, per-project rules...
}
}
You can optionally create an .eslintignore
file to ignore file paths. The .eslintignore
file is a plain text file where each line is a glob pattern indicating which paths should be omitted from linting. For example, the following will ignore all files in the tests
and coverage
folders:
**/tests/*
**/coverage/*
For information on how to contribute to this config, please see the Contributing guidelines.
We should be maintaining this config by updating plugins to the latest versions, and upgrading ESLint when a new version is available in order to keep up to date with new rules and syntax changes.
1.0.0 (2018-03-06)
eslint-plugin-node
to an optional add oneslint-plugin-jest
as an optional add onFAQs
ESLint shareable config used at Springer Nature
The npm package @springernature/eslint-config receives a total of 8,208 weekly downloads. As such, @springernature/eslint-config popularity was classified as popular.
We found that @springernature/eslint-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 17 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.