
Security News
Cline CLI npm Package Compromised via Suspected Cache Poisoning Attack
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.
eslint-plugin-react-x
Advanced tools
A set of composable ESLint rules for for libraries and frameworks that use React as a UI runtime.
4-7x faster, composable ESLint rules for for libraries and frameworks that use React as a UI runtime.
# npm
npm install --save-dev eslint-plugin-react-x
// eslint.config.js
// @ts-check
import js from "@eslint/js";
import react from "eslint-plugin-react-x";
import { defineConfig } from "eslint/config";
import tseslint from "typescript-eslint";
export default defineConfig(
{
files: ["**/*.{ts,tsx}"],
extends: [
js.configs.recommended,
tseslint.configs.recommended,
react.configs.recommended,
],
rules: {
// Put rules you want to override here
"react-x/no-class-component": "warn",
},
},
);
jsx-dollar - Prevents unnecessary $ symbols before JSX expressions (๐ง Fixable)jsx-key-before-spread - Enforces key prop placement before spread props (๐งช Experimental)jsx-no-comment-textnodes - Prevents comment strings (e.g., beginning with // or /*) from being accidentally inserted into a JSX element's text nodesjsx-no-duplicate-props - Disallows duplicate props in JSX elementsjsx-no-iife - Disallows immediately-invoked function expressions in JSX (๐งช Experimental)jsx-no-undef - Prevents using variables in JSX that are not defined in the scopejsx-shorthand-boolean - Enforces shorthand syntax for boolean props (๐ง Fixable, โ๏ธ Configurable)jsx-shorthand-fragment - Enforces shorthand syntax for fragment elements (๐ง Fixable, โ๏ธ Configurable)jsx-uses-react - Marks React variables as used when JSX is presentjsx-uses-vars - Marks JSX element variables as usedno-array-index-key - Disallows using an item's index in the array as its keyno-create-ref - Disallows createRef in function componentsno-duplicate-key - Prevents duplicate key props on sibling elements when rendering listsno-implicit-key - Prevents key from not being explicitly specified (e.g., spreading key from objects) (๐งช Experimental)no-missing-key - Disallows missing key on items in list renderingno-unnecessary-key - Disallows unnecessary key props on nested child elements when rendering lists (๐งช Experimental)no-create-ref - Disallows createRef in function componentsno-forward-ref - Replaces usage of forwardRef with passing ref as a prop (๐ Codemod, React >=19.0.0)no-unnecessary-use-ref - Disallows unnecessary usage of useRef (๐งช Experimental)no-useless-forward-ref - Disallows useless forwardRef calls on components that don't use refsno-children-prop - Disallows passing children as a propno-default-props - Disallows the defaultProps property in favor of ES6 default parametersno-prop-types - Disallows propTypes in favor of TypeScript or another type-checking solutionno-unstable-default-props - Prevents using referential-type values as default props in object destructuring (โ๏ธ Configurable)no-unused-props - Warns about component props that are defined but never used (๐ญ Type Checking, ๐งช Experimental)prefer-destructuring-assignment - Enforces destructuring assignment for component props and contextprefer-read-only-props - Enforces read-only props in components (๐ญ Type Checking, ๐งช Experimental)no-context-provider - Replaces usage of <Context.Provider> with <Context> (๐ Codemod, React >=19.0.0)no-unstable-context-value - Prevents non-stable values (i.e., object literals) from being used as a value for Context.Providerno-use-context - Replaces usage of useContext with use (๐ Codemod, React >=19.0.0)prefer-destructuring-assignment - Enforces destructuring assignment for component props and contextno-nested-component-definitions - Disallows nesting component definitions inside other componentsno-nested-lazy-component-declarations - Disallows nesting lazy component declarations inside other componentsno-leaked-conditional-rendering - Prevents problematic leaked values from being renderedno-unnecessary-use-callback - Disallows unnecessary usage of useCallback (๐งช Experimental)no-unnecessary-use-memo - Disallows unnecessary usage of useMemo (๐งช Experimental)no-unstable-context-value - Prevents non-stable values (i.e., object literals) from being used as a value for Context.Providerno-unstable-default-props - Prevents using referential-type values as default props in object destructuring (โ๏ธ Configurable)prefer-use-state-lazy-initialization - Enforces wrapping function calls made inside useState in an initializer functionno-clone-element - Disallows cloneElementno-children-count - Disallows the use of Children.count from the react packageno-children-for-each - Disallows the use of Children.forEach from the react packageno-children-map - Disallows the use of Children.map from the react packageno-children-only - Disallows the use of Children.only from the react packageno-children-to-array - Disallows the use of Children.toArray from the react packageno-access-state-in-setstate - Disallows accessing this.state inside setState callsno-class-component - Disallows class components except for error boundariesno-component-will-mount - Replaces usage of componentWillMount with UNSAFE_componentWillMount (๐ Codemod, React >=16.3.0)no-component-will-receive-props - Replaces usage of componentWillReceiveProps with UNSAFE_componentWillReceiveProps (๐ Codemod)no-component-will-update - Replaces usage of componentWillUpdate with UNSAFE_componentWillUpdate (๐ Codemod)no-direct-mutation-state - Disallows direct mutation of this.stateno-redundant-should-component-update - Disallows shouldComponentUpdate when extending React.PureComponentno-set-state-in-component-did-mount - Disallows calling this.setState in componentDidMount outside functions such as callbacksno-set-state-in-component-did-update - Disallows calling this.setState in componentDidUpdate outside functions such as callbacksno-set-state-in-component-will-update - Disallows calling this.setState in componentWillUpdate outside functions such as callbacksno-string-refs - Replaces string refs with callback refs (๐ Codemod, React >=16.3.0)no-unsafe-component-will-mount - Warns about the use of UNSAFE_componentWillMount in class componentsno-unsafe-component-will-receive-props - Warns about the use of UNSAFE_componentWillReceiveProps in class componentsno-unsafe-component-will-update - Warns about the use of UNSAFE_componentWillUpdate in class componentsno-unused-class-component-members - Warns about unused class component methods and propertiesno-unused-state - Warns about unused class component stateno-missing-component-display-name - Enforces that all components have a displayName that can be used in DevToolsno-missing-context-display-name - Enforces that all contexts have a displayName that can be used in DevTools (๐ง Fixable)no-misused-capture-owner-stack - Prevents incorrect usage of captureOwnerStack (๐งช Experimental)no-unnecessary-use-prefix - Enforces that a function with the use prefix uses at least one Hook inside itno-useless-fragment - Disallows useless fragment elements (๐ง Fixable, โ๏ธ Configurable)prefer-namespace-import - Enforces importing React via a namespace importFAQs
A set of composable ESLint rules for libraries and frameworks that use React as a UI runtime.
The npm package eslint-plugin-react-x receives a total of 507,087 weekly downloads. As such, eslint-plugin-react-x popularity was classified as popular.
We found that eslint-plugin-react-x demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.

Product
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.

Product
Socket now supports PHP with full Composer and Packagist integration, enabling developers to search packages, generate SBOMs, and protect their PHP dependencies from supply chain threats.