
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
eslint-plugin-unused-imports
Advanced tools
Find and remove unused es6 module imports. It works by splitting up the no-unused-vars rule depending on it being an import statement in the AST and providing an autofix rule to remove the nodes if they are imports. This plugin composes the rule no-unused-vars of either the typescript or js plugin so be aware that the other plugins needs to be installed and reporting correctly for this to do so.
If running typescript with @typescript-eslint make sure to use both @typescript-eslint/eslint-plugin and @typescript-eslint/parser.
If writing react code you need to install eslint-plugin-react and enable the two rules react/jsx-uses-react and react/jsx-uses-vars. Otherwise all imports for components will be reported unused.
You'll first need to install ESLint (and @typescript-eslint if using typescript):
npm i eslint --save-dev
Next, install eslint-plugin-unused-imports:
npm install eslint-plugin-unused-imports --save-dev
Note: If you installed ESLint globally (using the -g flag) then you must also install eslint-plugin-unused-imports globally.
Add unused-imports to the plugins section of your eslint.config.js configuration file.
import unusedImports from "eslint-plugin-unused-imports";
export default [{
plugins: {
"unused-imports": unusedImports,
},
rules: {
"no-unused-vars": "off", // or "@typescript-eslint/no-unused-vars": "off",
"unused-imports/no-unused-imports": "error",
"unused-imports/no-unused-vars": [
"warn",
{
"vars": "all",
"varsIgnorePattern": "^_",
"args": "after-used",
"argsIgnorePattern": "^_",
},
]
}
}];
no-unused-importsno-unused-varsThis package includes a variety of linting rules for import/export syntax, including a rule to detect unused imports. It is more comprehensive than eslint-plugin-unused-imports, offering a wider range of import-related linting features.
This package provides linting rules to help ensure that tree shaking is effective by marking side-effectful module imports. It is similar in its goal to reduce bundle size but focuses more on the side effects rather than just unused imports.
FAQs
Report and remove unused es6 modules
The npm package eslint-plugin-unused-imports receives a total of 6,695,525 weekly downloads. As such, eslint-plugin-unused-imports popularity was classified as popular.
We found that eslint-plugin-unused-imports demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.