
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
eslint-config-react-app
Advanced tools
This package includes the shareable ESLint configuration used by Create React App.
Please refer to its documentation:
The easiest way to use this configuration is with Create React App, which includes it by default.
You don’t need to install it separately in Create React App projects.
If you want to use this ESLint configuration in a project not built with Create React App, you can install it with the following steps.
First, install this package and ESLint.
npm install --save-dev eslint-config-react-app eslint@^8.0.0
Then create a file named .eslintrc.json with following contents in the root folder of your project:
{
"extends": "react-app"
}
That's it! You can override the settings from eslint-config-react-app by editing the .eslintrc.json file. Learn more about configuring ESLint on the ESLint website.
This config also ships with optional Jest rules for ESLint (based on eslint-plugin-jest).
You can enable these rules by adding the Jest config to the extends array in your ESLint config.
{
"extends": ["react-app", "react-app/jest"]
}
The following rules from the eslint-plugin-jsx-a11y plugin are activated:
If you want to enable even more accessibility rules, you can create an .eslintrc.json file in the root of your project with this content:
{
"extends": ["react-app", "plugin:jsx-a11y/recommended"],
"plugins": ["jsx-a11y"]
}
However, if you are using Create React App and have not ejected, any additional rules will only be displayed in the IDE integrations, but not in the browser or the terminal.
This package provides Airbnb's ESLint configuration, which is a popular style guide in the JavaScript community. It includes React-specific linting rules and differs from eslint-config-react-app by enforcing stricter code conventions and patterns.
This is an ESLint configuration package that extends the StandardJS ruleset with React-specific rules. It offers a different set of opinions on code style and best practices compared to eslint-config-react-app.
eslint-config-prettier disables all ESLint rules that might conflict with Prettier formatting. While it doesn't provide React-specific rules, it's often used in conjunction with other ESLint configs, like eslint-config-react-app, to ensure code style consistency.
FAQs
ESLint configuration used by Create React App
The npm package eslint-config-react-app receives a total of 1,821,142 weekly downloads. As such, eslint-config-react-app popularity was classified as popular.
We found that eslint-config-react-app demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.