
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
eslint-plugin-go-internal
Advanced tools
ESLint plugin that enforces Go-style internal/ import boundaries
An ESLint plugin that enforces Go-style internal/ import boundaries to maintain clean module architecture.
This plugin implements the Go programming language's "internal" package convention for JavaScript/TypeScript projects. It prevents modules from importing from other modules' internal/
directories, ensuring that internal implementation details remain private to their containing module.
npm install --save-dev eslint-plugin-go-internal
Add go-internal
to the plugins section of your .eslintrc
configuration file:
{
"plugins": ["go-internal"]
}
Then configure the rule under the rules section:
{
"rules": {
"go-internal/no-cross-internal-imports": "error"
}
}
Or use the recommended configuration:
{
"extends": ["plugin:go-internal/recommended"]
}
The rule follows this algorithm:
.
(not npm packages)project/
├── auth/
│ ├── handlers/
│ │ └── login.js ✅ Can import from auth/internal/
│ ├── internal/
│ │ ├── crypto.js
│ │ └── session.js
│ └── middleware.js ✅ Can import from auth/internal/
├── payment/
│ ├── handlers/
│ │ └── checkout.js ❌ Cannot import from auth/internal/
│ ├── internal/
│ │ └── stripe.js
│ └── processor.js ❌ Cannot import from auth/internal/
└── shared/
├── utils.js ❌ Cannot import from auth/internal/
└── constants.js ❌ Cannot import from payment/internal/
// ✅ auth/handlers/login.js
import { encrypt } from '../internal/crypto';
import { createSession } from '../internal/session';
// ✅ auth/middleware.js
import { validateToken } from './internal/crypto';
// ✅ payment/processor.js
import { formatAmount } from './internal/stripe';
// ✅ Non-internal imports are always allowed
import { helper } from '../shared/utils';
import { lodash } from 'lodash';
// ❌ payment/handlers/checkout.js
import { encrypt } from '../../auth/internal/crypto';
// ^^^^^^^^^^^^^^^^^^^^^^^^^^
// Error: Do not import internal modules from outside their module root.
// ❌ shared/utils.js
import { stripe } from '../payment/internal/stripe';
// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
// Error: Do not import internal modules from outside their module root.
// ❌ auth/handlers/login.js
const validator = require('../../payment/internal/validator');
// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
// Error: Do not import internal modules from outside their module root.
project/
├── core/
│ ├── database/
│ │ ├── internal/
│ │ │ └── connection.js
│ │ └── models.js ✅ Can import from database/internal/
│ └── auth/
│ └── service.js ❌ Cannot import from database/internal/
If a path contains multiple internal
folders, the rule uses the last occurrence:
// mymodule/src/component.js
import { util } from '../other/helpers/internal/shared/internal/util';
// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
// The internal root is: ../other/helpers/internal/shared/
// Rule checks if mymodule/ is within that root (it's not, so this fails)
The rule works with:
.js
, .jsx
).ts
, .tsx
)This rule has no configuration options. It's designed to work out of the box with the Go-style internal convention.
Issues and pull requests are welcome! Please make sure to run the tests:
npm test
MIT
FAQs
ESLint plugin that enforces Go-style internal/ import boundaries
The npm package eslint-plugin-go-internal receives a total of 1,288 weekly downloads. As such, eslint-plugin-go-internal popularity was classified as popular.
We found that eslint-plugin-go-internal demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.