Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
eslint-plugin-import-alias
Advanced tools
An ESLint rule for forcing import path aliases.
npm install --save-dev eslint-plugin-import-alias
import { test } from '@src/test'; // valid
import { test } from './test'; // invalid
import { test } from '../test'; // invalid
// Optional relative depth can be specified.
import { test } from './test'; // valid, { relativeDepth: 0 }
import { test } from '../test'; // valid, { relativeDepth: 1 }
import { test } from '../../test'; // invalid, { relativeDepth: 1 }
{
"rules": {
"import-alias/import-alias": [
"error",
{
"relativeDepth": 0,
"aliases": [
{ "alias": "@src", "matcher": "^src" }, // src/modules/app/test -> @src/modules/app/test
{ "alias": "@test", "matcher": "^test\/unit" }, // test/unit/modules/app -> @test/modules/app
{ "alias": "@testRoot", "matcher": "^(test)\/e2e" } // test/e2e/modules/app -> @testRoot/e2e/modules/app
]
}
]
}
}
Aliases can be configured to fix the path and rewrite to an aliased path. Each alias has the alias text and a regex matcher that will match against the resolved path from the root directory of the eslint process (usually the project root). For example, if the resolved file path is in the 'src' folder (src/modules/app/test) then 'src' will be replaced with '@src'. Optionally, you can define a capture group to replace only the part within the capture group, but still match against the whole regex.
A 'rootDir' can be defined to resolve the file paths from. This defaults to process.cwd()
. In a lot of cases, this is already the project root in most cases.
module.exports = {
"rules": {
"import-alias/import-alias": [
"error",
{
"relativeDepth": 0,
"rootDir": __dirname,
"aliases": [
{ "alias": "@src", "matcher": "^src" } // src/modules/app/test -> @src/modules/app/test
]
}
]
}
};
FAQs
ESLint rule for restricting imports to path aliases
The npm package eslint-plugin-import-alias receives a total of 11,631 weekly downloads. As such, eslint-plugin-import-alias popularity was classified as popular.
We found that eslint-plugin-import-alias demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.