Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
tslint-react
Advanced tools
Lint rules related to React & JSX for TSLint.
tslint-react has peer dependencies on TSLint and TypeScript.
To use these lint rules with the default preset, use configuration inheritance via the extends
keyword.
Here's a sample configuration where tslint.json
lives adjacent to your node_modules
folder:
{
"extends": ["tslint:latest", "tslint-react"],
"rules": {
// override tslint-react rules here
"jsx-wrap-multiline": false
}
}
To lint your .ts
and .tsx
files you can simply run tslint -c tslint.json 'src/**/*.{ts,tsx}'
.
The built-in configuration preset you get with "extends": "tslint-react"
is semantically versioned in a manner similar to TSLint's built-in presets and the TypeScript language itself. As new rules are added to tslint-react across minor versions, stricter checks may be enabled here. Your code is not guaranteed to continue passing checks across these version bumps. If you wish to ensure that npm upgrade
or yarn upgrade
never breaks your build, declare a tilde dependency on this package (e.g. "~1.0.0"
).
jsx-alignment
// Good:
const element = <div
className="foo"
tabIndex={1}
>
{children}
</div>;
// Also Good:
<Button
appearance="pretty"
disabled
label="Click Me"
size={size}
/>
jsx-ban-elements
(since v3.4.0)
jsx-ban-props
(since v2.3.0)
jsx-boolean-value
(since v2.5.0)
["always", "never"]
always
.jsx-curly-spacing
(since v1.1.0)
["always", "never"]
jsx-equals-spacing
(since v3.2.0)
=
token in JSX element attributes.["always", "never"]
jsx-key
(since v3.2.0)
key
props in JSX element array literals and inside return statements of Array.prototype.map
callbacks.
.map(...)
syntax and does not inspect computed types of expressions. As such, it may produce false positives if you use APIs that look similar to .map()
.jsx-no-bind
(since v2.6.0)
jsx-no-lambda
in helping you avoid excessive re-renders..bind
function and supply this
as a parameter.jsx-no-lambda
function
syntax or ES2015 arrow syntax) inside the render
call stack works against pure component rendering. When doing an equality check between two lambdas, React will always consider them unequal values and force the component to re-render more often than necessary.jsx-no-multiline-js
jsx-no-string-ref
ref
prop of React elements is considered a legacy feature and will soon be deprecated.
Instead, use a callback.jsx-use-translation-function
(since v2.4.0)
["allow-punctuation", "allow-htmlentities"]
jsx-self-close
(since v0.4.0)
// bad
<div className="foo"></div>
// good
<div className="foo" />
jsx-space-before-trailing-slash
jsx-wrap-multiline
(since v2.1)
// bad
const button = <button type="submit">
Submit
</button>;
// good
const button = (
<button type="submit">
Submit
</button>
);
We track rule suggestions on Github issues -- here's a useful link to view all the current suggestions. Tickets are roughly triaged by priority (P1, P2, P3).
We're happy to accept PRs for new rules, especially those marked as Status: Accepting PRs. If submitting a PR, try to follow the same style conventions as the core TSLint project.
Quick Start (requires Node v6+, yarn v0.22+):
yarn
yarn verify
yarn lint
See the Github release history.
FAQs
Lint rules related to React & JSX for TSLint
The npm package tslint-react receives a total of 156,080 weekly downloads. As such, tslint-react popularity was classified as popular.
We found that tslint-react demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.