npmpackage.info

Gathering detailed insights and metrics for @rushstack/eslint-plugin-security

@rushstack/eslint-plugin-security - 0.11.0 | npmpackage.info

@rushstack/eslint-plugin-security

Monorepo for tools developed by the Rush Stack community

0.11.0

6,232

NOASSERTION

TypeScript

26.98 kB

5.1

Installations

npm install @rushstack/eslint-plugin-security

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Node Version

20.19.2

NPM Version

10.8.2 Pull Requests

Open

117

Total

3,384

Closed

270

Merged

2,997

Issues

Open

820

Total

1,860

Closed

1,040

Releases

Unable to fetch releases

Languages

TypeScript

JavaScript

SCSS

Shell

HTML

CSS

Sass

Batchfile

TypeScript (95.75%)

JavaScript (3.94%)

SCSS (0.15%)

Shell (0.05%)

HTML (0.04%)

CSS (0.03%)

Sass (0.03%)

Batchfile (0.01%)

Developer

microsoft

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

NOASSERTION License

6,232 Stars

22,499 Commits

636 Forks

53 Watchers

103 Branches

286 Contributors

Updated on Jul 15, 2025

Maintainers

View All 286 Contributors

Package Meta Information

Latest Version

0.11.0

Package Id

@rushstack/eslint-plugin-security@0.11.0

Unpacked Size

26.98 kB

Size

7.11 kB

File Count

NPM Version

10.8.2

Node Version

20.19.2

Published on

Jun 26, 2025

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

@rushstack/eslint-plugin-security

This plugin implements a collection of security rules for ESLint.

Our ambition is to eventually provide a comprehensive set of recommended security rules for:

web browser applications
Node.js tools
Node.js services

If you would like to request or contribute a new security rule, you are encouraged to create a GitHub issue in the Rush Stack monorepo where this project is developed. Thanks!

`@rushstack/security/no-unsafe-regexp`

Require regular expressions to be constructed from string constants rather than dynamically building strings at runtime.

Rule Details

Regular expressions should be constructed from string constants. Dynamically building strings at runtime may introduce security vulnerabilities, performance concerns, and bugs involving incorrect escaping of special characters.

Examples

The following patterns are considered problems when @rushstack/security/no-unsafe-regexp is enabled:

1function parseRestResponse(request: ICatalogRequest,
2  items: ICatalogItem[]): ICatalogItem[] {
3
4  // Security vulnerability: A malicious user could invoke the REST service using a
5  // "searchPattern" with a complex RegExp that causes a denial of service.
6  const regexp: RegExp = new RegExp(request.searchPattern);
7  return items.filter(item => regexp.test(item.title));
8}

1function hasExtension(filePath: string, extension: string): boolean {
2  // Escaping mistake: If the "extension" string contains a special character such as ".",
3  // it will be interpreted as a regular expression operator. Correctly escaping an arbitrary
4  // string is a nontrivial problem due to RegExp implementation differences, as well as contextual
5  // issues (since which characters are special changes inside RegExp nesting constructs).
6  // In most cases, this problem is better solved without regular expressions.
7  const regexp: RegExp = new RegExp(`\.${extension}$`);
8  return regexp.test(filePath);
9}

The following patterns are NOT considered problems:

1function isInteger(s: string): boolean {
2  return /[0-9]+/.test(s);
3}

1function isInteger(s: string): boolean {
2  return new RegExp('[0-9]+').test(s);
3}

10

Maintained

Determines if the project is "actively maintained".

10

Security-Policy

Determines if the project has published a security policy.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

9

License

Determines if the project has defined a license.

4

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

SAST

Determines if the project uses static code analysis.

0

Fuzzing

Determines if the project uses fuzzing.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

5.1

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

@rushstack/eslint-plugin-security

Installations

Developer Guide

No

CommonJS

20.19.2

10.8.2

Pull Requests

117

3,384

270

2,997

Issues

820

1,860

1,040

Releases

Unable to fetch releases

Languages

Developer

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

NaN

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Peer Dependencies

Dev Dependencies

@rushstack/eslint-plugin-security

@rushstack/security/no-unsafe-regexp

Rule Details

Examples

Links

10

10

10

10

9

4

3

0

0

0

0

0

5.1

/10

`@rushstack/security/no-unsafe-regexp`