Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
eslint-plugin-sort-imports-requires
Advanced tools
An ESLint plugin to sort both import and require declarations in a unified manner.
An ESLint plugin to sort both import and require declarations in a unified manner.
ESLint's sort-imports
only works for import
statements. However, require
statements are still being widely used. We needed to validate import
and require
statements in a similar way throughout our codebase and we couldn't find an OSS package that would address this need with the features we require.
This plugin is a drop-in replacement to sort-imports
with a few extra features:
unsafeAutofix
).useAliases
).multiple
type corresponds to all named imports, regardless of how many are imported (see useOldSingleMemberSyntax
).You'll first need to install ESLint:
npm install eslint --save-dev
Next, install eslint-plugin-sort-imports-requires
:
npm install eslint-plugin-sort-imports-requires --save-dev
Add sort-imports-requires
to the plugins section of your ESLint configuration file and configure its rules. Here's an example:
// eslint.config.js
import sortImportRequires from 'eslint-plugin-sort-imports-requires';
export default [
{
plugins: {
'sort-imports-requires': sortImportRequires
},
rules: {
'sort-imports-requires/sort-imports': ['error', { unsafeAutofix: true }],
'sort-imports-requires/sort-requires': ['error', { unsafeAutofix: true }]
}
}
];
sort-imports
and sort-requires
These are the only supported rules and can be configured independently. Both have exactly the same options as ESLint's sort-imports
rule, with a few more options:
unsafeAutofix
(default: false
)useAliases
(default: true
)useOldSingleMemberSyntax
(default: false
)unsafeAutofix
Whether to autofix potentially unsafe scenarios automatically when the --fix
flag is used when calling eslint
.
The current scenarios considered unsafe are:
sort-imports
rule does not autofix.const { [foo()]: bar } = require('bar')
. In this scenario, the order in which keys are declared might matter.Enable this option at your own discretion.
useAliases
Whether to use aliases when sorting.
Consider the following import:
import { foo as bar } from 'some-module';
If useAliases
is enabled, bar
is used when sorting. If it was disabled, foo
would have been used instead.
useOldSingleMemberSyntax
Whether to restore the old ESLint behavior where multiple
type corresponds to all named imports (regardless of how many are imported), while the single
type corresponds only to default imports.
Install dependencies:
npm i
Run tests:
npm run test
The release process is automated via the release GitHub workflow. Run it by clicking the "Run workflow" button.
v2.0.0 (2024-10-16)
repository
to package.json #9 (satazor)FAQs
An ESLint plugin to sort both import and require declarations in a unified manner.
The npm package eslint-plugin-sort-imports-requires receives a total of 8,028 weekly downloads. As such, eslint-plugin-sort-imports-requires popularity was classified as popular.
We found that eslint-plugin-sort-imports-requires demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.