
Security News
curl Shuts Down Bug Bounty Program After Flood of AI Slop Reports
A surge of AI-generated vulnerability reports has pushed open source maintainers to rethink bug bounties and tighten security disclosure processes.
eslint-plugin-lodash-es
Advanced tools
ESLint plugin that enforces destructured imports from lodash-es and auto-fixes them
ESLint plugin that enforces destructured imports from lodash-es with auto-fixing and provides configurable function usage policies.
Key Benefits:
npm install -D eslint-plugin-lodash-es
// eslint.config.js (ESLint 9+)
import eslintPluginLodashEs from 'eslint-plugin-lodash-es'
export default [
...eslintPluginLodashEs.configs.recommended
]
import { defineConfig } from 'eslint/config'
// Base
import globals from 'globals'
import eslint from '@eslint/js'
import tseslint from 'typescript-eslint'
// Plugins
import eslintPluginStylistic from '@stylistic/eslint-plugin'
import eslintPluginLodashEs from 'eslint-plugin-lodash-es'
export default defineConfig(
{
ignores: ['dist/', 'node_modules/', 'coverage/'],
},
{
languageOptions: {
globals: {
...globals.browser, // or globals.node
},
},
},
//Base
eslint.configs.recommended,
tseslint.configs.strict,
tseslint.configs.stylistic,
// Plugins
eslintPluginStylistic.configs.recommended,
eslintPluginLodashEs.configs.recommended
)
// eslint.config.js (ESLint 9+)
export default [
{
plugins: { 'lodash-es': eslintPluginLodashEs },
rules: {
'lodash-es/enforce-destructuring': 'error',
'lodash-es/no-chaining': 'error',
'lodash-es/no-method-imports': 'error',
'lodash-es/enforce-functions': ['error', { exclude: ['forEach'] }],
'lodash-es/suggest-native-alternatives': 'warn',
}
}
]
// .eslintrc.js
module.exports = {
extends: ['plugin:lodash-es/recommended-legacy']
}
Transforms this:
import _ from 'lodash-es'
const result = _.first([1, 2, 3])
Into this (automatically):
import { first } from 'lodash-es'
const result = first([1, 2, 3])
Transforms this:
import { map, first, groupBy } from 'lodash-es'
const doubled = map([1, 2, 3], x => x * 2)
const firstItem = first(items)
const grouped = groupBy(users, 'department')
Into this (automatically):
import { map, first, groupBy } from 'lodash-es'
const doubled = [1, 2, 3].map(x => x * 2)
const firstItem = items.at(0)
const grouped = Object.groupBy(users, user => user.department)
Supports 104+ lodash functions with automatic transformation to modern JavaScript equivalents, including ES2022+ features like Array.at() and Object.groupBy().
Array slice operations: drop, dropRight, take, takeRight
Math & arithmetic: add, subtract, multiply, divide, sum, mean
Number utilities: clamp, inRange, random
String transformations: capitalize, lowerFirst, upperFirst (using modern .at())
Type checking: isDate, isRegExp, isError, isSet, isWeakMap, isWeakSet, isSymbol, isSafeInteger
Type conversion: castArray, toArray, toFinite, toInteger, toSafeInteger
Comparisons: eq, gt, gte, lt, lte
Function utilities: bind, delay, defer
Object creation: create
Utility stubs: identity, noop, stubArray, stubFalse, stubObject, stubString, stubTrue
| Rule | Description | đź’ˇ | đź”§ | âś… |
|---|---|---|---|---|
| enforce-destructuring | Enforce destructured imports from lodash-es | đź”§ | âś… | |
| no-chaining | Prevent chaining that kills tree-shaking | đź’ˇ | đź”§ | âś… |
| no-method-imports | Prevent deprecated per-method imports | đź’ˇ | đź”§ | âś… |
| enforce-functions | Transform lodash functions to native JavaScript | đź’ˇ | đź”§ | |
| suggest-native-alternatives | Suggest native JavaScript alternatives | đź’ˇ | đź”§ |
Legend: 💡 Suggestions • 🔧 Auto-fixable • ✅ Recommended
Bundle Size: Reduces bundle from ~70KB (full lodash-es) to ~1KB per function
Better Tree Shaking: Modern bundlers eliminate unused code more effectively
Team Standards: Enforce consistent lodash usage across your codebase
See detailed rule documentation for configuration options and examples.
Contributions welcome! See CONTRIBUTING.md for details.
FAQs
ESLint plugin that enforces destructured imports from lodash-es and auto-fixes them
We found that eslint-plugin-lodash-es demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A surge of AI-generated vulnerability reports has pushed open source maintainers to rethink bug bounties and tighten security disclosure processes.

Product
Scan results now load faster and remain consistent over time, with stable URLs and on-demand rescans for fresh security data.

Product
Socket's new Alert Details page is designed to surface more context, with a clearer layout, reachability dependency chains, and structured review.