Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@stencil-community/eslint-plugin
Advanced tools
ESLint rules specific to Stencil JS projects.
If you're using npm v7+, you only need to install this package. Its peer dependencies will be automatically installed.
npm i --save-dev @stencil-community/eslint-plugin
If you're using npm v6 or lower, you will need to install this package and its peer dependencies in your stencil project:
npm i --save-dev eslint @typescript-eslint/parser @typescript-eslint/eslint-plugin eslint-plugin-react @stencil-community/eslint-plugin typescript
.eslintrc.json
configuration file:
{
"parserOptions": {
"project": "./tsconfig.json"
},
"extends": [
"plugin:@stencil-community/recommended"
]
}
Add a new lint
script to the package.json
:
{
"scripts": {
"lint": "eslint src/**/*{.ts,.tsx}"
}
}
By default, ESLint will ignore your node_modules/
directory. Consider adding a .eslintignore
file at the root of
your project with any output target directories to avoid false positive errors from ESLint.
# place any directories created by the Stencil compilation process here
dist
loader
www
Lint all your project:
npm run lint
This rule catches Stencil public methods that are not async.
This rule catches Stencil Props with a default value of true
.
This rule catches Stencil Component banned tag name prefix.
This rule catches Stencil Component class name not matching configurable pattern.
This rule catches Stencil decorators in bad locations.
This rule catches Stencil decorators style usage.
This rule catches Stencil Element decorator have the correct type.
This rule catches Stencil method hostData.
This rule catches Stencil Methods marked as private or protected.
This rule catches Stencil Watchs with non existing Props or States.
This rule catches own class methods marked as public.
This rule catches own class properties marked as public.
This rule catches Stencil Listen with vdom events.
This rule catches Stencil Props marked as private or protected.
This rule catches Stencil Props marked as non readonly, excluding mutable ones.
This rule catches Stencil Render returning array instead of Host tag.
This rule catches Stencil Props, Methods and Events to define jsdoc.
This rule catches Stencil Component required tag name prefix.
This rule catches Stencil Prop names that share names of Global HTML Attributes.
This rule catches modules that expose more than just the Stencil Component itself.
This rule catches Stencil Prop marked as mutable but not changing value in code.
{
"@stencil-community/async-methods": "error",
"@stencil-community/ban-prefix": ["error", ["stencil", "stnl", "st"]],
"@stencil-community/decorators-context": "error",
"@stencil-community/decorators-style": [
"error", {
"prop": "inline",
"state": "inline",
"element": "inline",
"event": "inline",
"method": "multiline",
"watch": "multiline",
"listen": "multiline"
}],
"@stencil-community/element-type": "error",
"@stencil-community/host-data-deprecated": "error",
"@stencil-community/methods-must-be-public": "error",
"@stencil-community/no-unused-watch": "error",
"@stencil-community/own-methods-must-be-private": "error",
"@stencil-community/own-props-must-be-private": "error",
"@stencil-community/prefer-vdom-listener": "error",
"@stencil-community/props-must-be-public": "error",
"@stencil-community/props-must-be-readonly": "error",
"@stencil-community/render-returns-host": "error",
"@stencil-community/required-jsdoc": "error",
"@stencil-community/reserved-member-names": "error",
"@stencil-community/single-export": "error",
"@stencil-community/strict-mutable": "error"
}
When submitting new rules please:
All contributions welcome.
FAQs
ESLint rules specific to Stencil JS projects.
The npm package @stencil-community/eslint-plugin receives a total of 18,877 weekly downloads. As such, @stencil-community/eslint-plugin popularity was classified as popular.
We found that @stencil-community/eslint-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.