
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
any-eslint-parser
Advanced tools
1 . Add dependencies:
package.json
:
..
"devDependencies": {
"any-eslint-parser": "1.0.0",
"eslint": "*",
2 . Configure eslint with the required rules, e.g. eol-last
and no-tabs
:
.eslintrc-any.json
:
{
"parser": "any-eslint-parser",
"rules": {
"eol-last": "error",
"no-tabs": "error"
}
}
Any eslint rule that not required AST can be used, this example uses
eol-last
andno-tabs
.
3 . Configure linting script:
package.json
:
"scripts": {
"lint.any": "eslint --config .eslintrc-any.json \"**/*.+(js|jsx|ts|tsx|json|yml|xml|sh|txt|md|svg|properties|gradle|java|cpp|c|html|css|groovy|gitignore|npmignore)\"",
any-eslint-parser
provides a parser so "any" type of file can be checked by eslint. Although eslint claims to be AST-based, there are rules that does not based on AST, rather they are based on the text content of the file, e.g. eol-last
, no-tabs
, eslint-plugin-regex
, etc.
any-eslint-parser
can be used to check json files, yaml files, script files, source code files in any programming language (e.g. java, c++, groovy, etc.), svg files, markdown files, etc.
This idea arise from the need to use
eslint-plugin-regex
in other type of files, besides javascript. (Then saw on this as a more versatile and configurable way to check common files than using lintspaces)
eslint-plugin-regex
.eslintrc-any.json
or any parent have rules that require AST, those will be ignored when using any-eslint-parser
..eslintrc.json
file when using any-eslint-parser
(take a look at Migrating to eslint/any-eslint-parser from lintspaces as detailed example).
--no-eslintrc
option can be very helpful since will ignore all configuration files, i.e .eslintrc.*
and package.json
, only taking in account the one set with --config
option.--ignore-pattern
or --ignore-path
.--no-eslintrc
, --ignore-pattern
and --ignore-path
are very useful when other parser are used in the project in order to avoid conflicts..eslintrc-any.json
{
"parser": "any-eslint-parser",
"rules": {
"eol-last": "error",
"no-tabs": "error"
}
}
package.json
:
"scripts": {
"lint.any": "eslint --config .eslintrc-any.json \"**/[\\.a-zA-Z]*.+(js|jsx|ts|tsx|json|yml|xml|sh|txt|md|svg|properties|gradle|java|cpp|c|html|css|groovy)\" \"**/.+(|gitignore|npmignore)\" --no-eslintrc --ignore-pattern \"build\""
},
"devDependencies": {
"any-eslint-parser": "1.0.0",
"eslint": "*"
}
More detail at Migrating to eslint/any-eslint-parser from lintspaces.
eslint-plugin-regex
Requiring Copyright
and License
on every source file of a project.
.eslintrc-any.json
{
"plugins": ["regex"],
"parser": "any-eslint-parser",
"rules": {
"regex/required": [
"error", [
"^(?:(?:\\/\\/)|#) Copyright \\(c\\) Super Team",
"^(?:(?:\\/\\/)|#) Licensed under the MIT License \\(MIT\\), see LICENSE.txt"
]
]
}
}
package.json
:
"scripts": {
"lint.any": "eslint --config .eslintrc-any.json \"**/*.+(js|jsx|ts|tsx|gradle|java|cpp|c|groovy|yml|sh)\""
},
"devDependencies": {
"any-eslint-parser": "1.0.0",
"eslint": "*",
"eslint-plugin-regex": "*"
}
More regex rules examples at eslint-plugin-regex
and eslint-plugin-base-style-config
regex rules.
Don't forget:
At life:
At work:
1.0.1 - May 2021
FAQs
Check Any file with ESLint
The npm package any-eslint-parser receives a total of 3,098 weekly downloads. As such, any-eslint-parser popularity was classified as popular.
We found that any-eslint-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.