Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
eslint-plugin-sort-imports-requires
Advanced tools
An ESLint plugin to sort both import and require declarations in a unified manner.
An ESLint plugin to sort both import and require declarations in a unified manner.
ESLint's sort-imports
only works for import
statements. However, require
statements are still being widely used. We needed to validate import
and require
statements in a similar way throughout our codebase and we couldn't find an OSS package that would address this need with the features we require.
This plugin is a drop-in replacement to sort-imports
with a few extra features:
unsafeAutofix
).useAliases
).multiple
type corresponds to all named imports, regardless of how many are imported (see useOldSingleMemberSyntax
).You'll first need to install ESLint:
npm install eslint --save-dev
Next, install eslint-plugin-sort-imports-requires
:
npm install eslint-plugin-sort-imports-requires --save-dev
Add sort-imports-requires
to the plugins section of your ESLint configuration file and configure its rules. Here's an example:
// eslint.config.js
import sortImportRequires from 'eslint-plugin-sort-imports-requires';
export default [
{
plugins: {
'sort-imports-requires': sortImportRequires
},
rules: {
'sort-imports-requires/sort-imports': ['error', { unsafeAutofix: true }],
'sort-imports-requires/sort-requires': ['error', { unsafeAutofix: true }]
}
}
];
sort-imports
and sort-requires
These are the only supported rules and can be configured independently. Both have exactly the same options as ESLint's sort-imports
rule, with a few more options:
unsafeAutofix
(default: false
)useAliases
(default: true
)useOldSingleMemberSyntax
(default: false
)unsafeAutofix
Whether to autofix potentially unsafe scenarios automatically when the --fix
flag is used when calling eslint
.
The current scenarios considered unsafe are:
sort-imports
rule does not autofix.const { [foo()]: bar } = require('bar')
. In this scenario, the order in which keys are declared might matter.Enable this option at your own discretion.
useAliases
Whether to use aliases when sorting.
Consider the following import:
import { foo as bar } from 'some-module';
If useAliases
is enabled, bar
is used when sorting. If it was disabled, foo
would have been used instead.
useOldSingleMemberSyntax
Whether to restore the old ESLint behavior where multiple
type corresponds to all named imports (regardless of how many are imported), while the single
type corresponds only to default imports.
Install dependencies:
npm i
Run tests:
npm run test
The release process is automated via the release GitHub workflow. Run it by clicking the "Run workflow" button.
FAQs
An ESLint plugin to sort both import and require declarations in a unified manner.
The npm package eslint-plugin-sort-imports-requires receives a total of 7,989 weekly downloads. As such, eslint-plugin-sort-imports-requires popularity was classified as popular.
We found that eslint-plugin-sort-imports-requires demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.