
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
eslint-plugin-no-use-extend-native
Advanced tools
ESLint plugin to prevent use of extended native objects
The eslint-plugin-no-use-extend-native package is an ESLint plugin that helps developers avoid using extended native objects. It ensures that code does not extend or modify native objects like Array, Object, etc., which can lead to unpredictable behavior and maintenance issues.
Prevent extending native objects
This feature prevents developers from adding custom methods to native objects like Array. The code sample shows an attempt to add a custom method to Array.prototype, which would be flagged by the plugin.
/* eslint no-use-extend-native/no-use-extend-native: 2 */
Array.prototype.customMethod = function() {
// some custom logic
};
Prevent modifying native object prototypes
This feature ensures that developers do not modify the prototypes of native objects like Object. The code sample demonstrates an attempt to add a custom property to Object.prototype, which would be flagged by the plugin.
/* eslint no-use-extend-native/no-use-extend-native: 2 */
Object.prototype.customProperty = 'customValue';
This plugin suggests native JavaScript alternatives to lodash and underscore methods. While it does not directly prevent extending native objects, it encourages the use of native methods, which aligns with the goal of avoiding unnecessary modifications to native objects.
ESLint plugin to prevent use of extended native objects
First, install ESLint via
npm install --save-dev eslint
Then install eslint-plugin-no-use-extend-native
npm install --save-dev eslint-plugin-no-use-extend-native
In your eslint.config.js
file add the plugin as such:
import eslintPluginNoUseExtendNative from 'eslint-plugin-no-use-extend-native'
export default [
{
plugins: {
'no-use-extend-native': eslintPluginNoUseExtendNative,
},
rules: {
'no-use-extend-native/no-use-extend-native': 2,
},
},
]
If you want the default of the single rule being enabled as an error, you can also just use the following instead of all of the above:
import eslintPluginNoUseExtendNative from 'eslint-plugin-no-use-extend-native'
export default [
eslintPluginNoUseExtendNative.configs.recommended,
]
With this plugin enabled, ESLint will find issues with using extended native objects:
import colors from 'colors';
console.log('unicorn'.green);
// => ESLint will give an error stating 'Avoid using extended native objects'
[].customFunction();
// => ESLint will give an error stating 'Avoid using extended native objects'
More examples can be seen in the tests.
ESLint's no-extend-native
rule verifies code is not modifying a native prototype. e.g., with the no-extend-native
rule enabled, the following lines are each considered incorrect:
String.prototype.shortHash = function() { return this.substring(0, 7); };
Object.defineProperty(Array.prototype, "times", { value: 999 });
no-use-extend-native
verifies code is not using a non-native prototype. e.g., with the no-use-extend-native
plugin enabled, the following line is considered incorrect:
"50bda47b09923e045759db8e8dd01a0bacd97370".shortHash() === "50bda47";
The no-use-extend-native
plugin is designed to work with ESLint's no-extend-native
rule. no-extend-native
ensures that native prototypes aren't extended, and should a third party library extend them, no-use-extend-native
ensures those changes aren't depended upon.
MIT © Dustin Specker
FAQs
ESLint plugin to prevent use of extended native objects
The npm package eslint-plugin-no-use-extend-native receives a total of 169,133 weekly downloads. As such, eslint-plugin-no-use-extend-native popularity was classified as popular.
We found that eslint-plugin-no-use-extend-native demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.