Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
eslint-plugin-lodash
Advanced tools
eslint-plugin-lodash is an ESLint plugin that provides linting rules for Lodash, a popular JavaScript utility library. The plugin helps ensure that Lodash is used in an optimal and consistent manner, promoting best practices and preventing common mistakes.
Prefer Lodash methods over native
This rule enforces the use of Lodash methods over native JavaScript methods. It ensures consistency and leverages Lodash's optimizations.
/* eslint lodash/prefer-lodash-method: [2] */
const _ = require('lodash');
const arr = [1, 2, 3];
// Bad: using native method
const doubled = arr.map(x => x * 2);
// Good: using Lodash method
const doubled = _.map(arr, x => x * 2);
Prefer _.get over direct property access
This rule encourages the use of _.get for property access, which is safer and avoids potential errors when accessing deeply nested properties.
/* eslint lodash/prefer-get: [2] */
const _ = require('lodash');
const obj = { a: { b: 2 } };
// Bad: direct property access
const value = obj.a.b;
// Good: using _.get
const value = _.get(obj, 'a.b');
Prefer _.isNil over _.isNull and _.isUndefined
This rule prefers the use of _.isNil, which checks for both null and undefined, over using _.isNull and _.isUndefined separately.
/* eslint lodash/prefer-is-nil: [2] */
const _ = require('lodash');
const value = null;
// Bad: using _.isNull and _.isUndefined
if (_.isNull(value) || _.isUndefined(value)) {
// do something
}
// Good: using _.isNil
if (_.isNil(value)) {
// do something
}
eslint-plugin-underscore is an ESLint plugin that provides linting rules for Underscore.js, another popular JavaScript utility library. It offers similar functionality to eslint-plugin-lodash but is tailored for Underscore.js instead of Lodash.
eslint-plugin-you-dont-need-lodash-underscore is an ESLint plugin that helps developers identify places where native JavaScript can be used instead of Lodash or Underscore.js. It promotes the use of native methods over utility libraries, contrasting with eslint-plugin-lodash which encourages the use of Lodash.
Lodash-specific linting rules for ESLint.
Install ESLint either locally or globally.
$ npm install eslint --save-dev
If you installed ESLint
globally, you have to install the Lodash plugin globally too. Otherwise, install it locally.
$ npm install eslint-plugin-lodash --save-dev
Add a plugins
section and specify ESLint-Plugin-Lodash as a plugin.
You can additionally add settings for the plugin.
These are settings that can be shared by all of the rules. All settings are under the lodash
inside the general settings
object. For more info about shared settings, read the ESLint Configuration Guide.
import
ed in ES6 modules or require
d in commonjs.4
).
If you wish to use this plugin with Lodash v3, this value should be 3
. (on by default in the config v3
)Finally, enable all of the rules that you would like to use.
This plugin exports a recommended
configuration that enforces all the rules.
You can configure the plugin as follows:
{
"plugins": ["lodash"],
"extends": ["plugin:lodash/recommended"]
}
If you work with the full Lodash object with the same variable name every time, you should use the canonical
configuration. This allows rules to run without explicitly importing Lodash in your code, and allows for faster execution for some of the rules:
{
"plugins": ["lodash"],
"extends": ["plugin:lodash/canonical"]
}
Out of the box, this plugin supports the use of Lodash v4. To use with Lodash v3, the config needs to specify the version in the settings
, and can't use some rules.
The plugin also exports a v3
config for ease of use.
{
"plugins": ["lodash"],
"extends": ["plugin:lodash/v3"]
}
Rules are divided into categories for your convenience. All rules are off by default, unless you use one of the plugin's configurations which turn all relevant rules on.
The following rules point out areas where you might have made mistakes.
thisArg
for Lodash method callbacks, depending on major version.forEach
..value()
on chains that have already ended (e.g. with max()
or reduce()
) (fixable)this
inside callbacks without binding them.value()
or non-chainable methods like max()
.,These rules are purely matters of style and are quite subjective.
sortBy
or orderBy
flow
or flowRight
.lodash/map
vs lodash
).commit()
on chains that should end with .value()
get
and property
: array, string, or arrays only for paths with variables. (fixable)_.compact
over _.filter
for only truthy values._.filter
over _.forEach
with an if
statement inside._.find
over _.filter
followed by selecting the first result._.flatMap
over consecutive map
and flatten
._.without
instead of _.pull
._.invoke
over _.map
with a method call inside._.map
over _.forEach
with a push
inside._.reject
over filter with !(expression)
or x.prop1 !== value
_.prototype.thru
in the chain and not call functions in the initial value, e.g. _(x).thru(f).map(g)...
_(str).split(' ')...
These rules are also stylistic choices, but they also recommend using Lodash instead of native functions and constructs.
For example, Lodash collection methods (e.g. map
, forEach
) are generally faster than native collection methods.
_.constant
over functions returning literals._.get
or _.has
over expression chains like a && a.b && a.b.c
._.includes
over comparing indexOf
to -1._.isNil
over checks for both null and undefined._.map
) over native and mixed chains._.map
) over native array methods._.is*
methods over typeof
and instanceof
checks when applicable._.matches
over conditions like a.foo === 1 && a.bar === 2 && a.baz === 3
._.noop
over empty functions._.overSome
and _.overEvery
instead of checks with &&
and ||
for methods that have a boolean check iteratee._.some
over comparing findIndex
to -1._.startsWith
over a.indexOf(b) === 0
._.times
over _.map
without using the iteratee's arguments.Contributions are always welcome! For more info, read our contribution guide.
ESLint-plugin-lodash is licensed under the MIT License.
FAQs
Lodash specific linting rules for ESLint
The npm package eslint-plugin-lodash receives a total of 388,758 weekly downloads. As such, eslint-plugin-lodash popularity was classified as popular.
We found that eslint-plugin-lodash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.