
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
eslint-plugin-scats
Advanced tools
ESLint plugin with rules for safer and more idiomatic usage of scats.
npm install --save-dev eslint eslint-plugin-scats
If you lint TypeScript, also install:
npm install --save-dev @typescript-eslint/parser
Recommended:
module.exports = {
plugins: ['scats'],
extends: ['plugin:scats/recommended'],
};
Strict:
module.exports = {
plugins: ['scats'],
extends: ['plugin:scats/strict'],
};
const scats = require('eslint-plugin-scats');
module.exports = [
{
plugins: {
scats,
},
rules: {
...scats.configs.recommended.rules,
},
},
];
For strict mode use scats.configs.strict.rules.
scats/to-array-terminal: requires .toArray to be terminal in scats call chainsscats/no-array-option-fallback: disallows Option#getOrElseValue([]), Option#getOrElse(() => []), Option#getOrElseValue(Nil.toArray), and similar array fallbacks; prefer keeping values as scats collections and using Nil or an appropriate empty collectionscats/no-collection-emptiness-comparison: prefers .isEmpty and .nonEmpty over comparing scats collection .length or .size to zeroscats/no-collection-get-zero: disallows Collection#get(0); prefer head or headOption to make first-element access explicitscats/no-explicit-empty: disallows creating obviously empty scats collections via constructors/factories when Nil or *.empty should be usedscats/no-option-nullish-fallback: disallows option(null)/option(undefined) in favor of none, disallows Option#getOrElse(() => null), Option#getOrElseValue(null), the corresponding undefined fallbacks, and redundant patterns such as option(existingOption.orNull) or option(existingOption.orNull).orElse(() => option(fallback.orNull)) when the original Option should be used directlyscats/no-option-foreach-assignment: disallows let result = none followed by mutation inside option(...).foreach(...); prefer deriving the value with map or flatMapscats/prefer-get-or-else-value: prefers Option#getOrElseValue(...) over Option#getOrElse(() => ...) when the callback returns an explicit constant such as a literal or static template string, and prefers Option#orElseValue(...) over Option#orElse(() => someOption) when the fallback is already an Optionscats/no-useless-to-array-iteration: disallows for...of (... of collection.toArray) for confirmed scats collections and auto-fixes to iterate the scats collection directlyrecommended rulesscats/no-array-construction: disallows storing JavaScript arrays in local variables or class fields; inline arrays and object property assignments for external APIs remain allowedscats/no-array-mutation: disallows mutating JavaScript arrays directly via mutating methods, index writes, or length = ...; this rule uses TypeScript type information to avoid false positives on non-array objects with methods like pushscats/no-array-typed-variable: disallows local variables and class fields typed as Array<T>, ReadonlyArray<T>, or T[]; this catches cases where .toArray results are stored explicitly as JavaScript arrays. For DTOs or external contracts, annotate the class with @scatsAllowArrayTypesscats/no-nullish-syntax: disallows ?. and ??; prefer explicit Option flows such as option(x).flatMap(...) and option(x).getOrElseValue(...)npm test
FAQs
ESLint rules for safe scats usage
We found that eslint-plugin-scats demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.