eslint
Safeguard articles tagged "eslint" — guides, analysis, and best practices for software supply chain and application security.
16 articles
ESLint rules for detecting Trojan Source (bidi Unicode) attacks in JS/TS
A single invisible Unicode character can flip how code executes versus how it reads on screen. Here's how to configure ESLint to catch it.
eslint-plugin-unused-imports: Cleaner Code, Smaller Surface
eslint-plugin-unused-imports auto-removes dead imports that the base ESLint rule only warns about. Here is how to configure it correctly on ESLint 9.
eslint-plugin-import and import-helpers: Order Your Imports, Catch Mistakes
eslint-plugin-import-helpers gives you fully configurable import ordering; eslint-plugin-import catches the real bugs — unresolved paths, phantom dependencies, cycles. Most codebases want both.
eslint-plugin-react-refresh: What It Does and Why It Matters
A guide to eslint-plugin-react-refresh: what the only-export-components rule enforces, how it relates to the react-refresh webpack plugin, and its security relevance.
eslint-import-resolver-typescript: A Security Guide
eslint-import-resolver-typescript lives in your dev toolchain, which is precisely the part of the supply chain attackers now target. Here is how to keep it clean.
@angular-eslint/schematics: Is the Angular ESLint Setup Package Safe?
A security review of @angular-eslint/schematics: what the package does, its install-time behavior, dependency footprint, and how to adopt it safely in an Angular workspace.
JavaScript Checker: How to Scan JavaScript Code for Bugs and Vulnerabilities
A JavaScript checker can mean a linter, a type checker, or a security scanner, and you want all three. Here is what each catches and how to wire them into one pipeline.
@babel/eslint-parser: A Security and Migration Guide
@babel/eslint-parser is the maintained ESLint parser for Babel-transformed JavaScript, replacing the deprecated babel-eslint. Here is why the rename happened and what it means for your toolchain.
JavaScript Static Analysis: Catching Bugs Before They Ship
JavaScript static analysis reads your code without running it to find bugs, security flaws, and risky patterns early. Here is what it can and cannot catch, and how to set it up well.
What Is Linting in Code? A Security Perspective
Linting is automated static analysis that catches bugs, style issues, and security anti-patterns before code runs. Here is what it does and where it fits in a secure pipeline.
@angular-eslint/builder: What It Is and How to Use It Safely
The @angular-eslint/builder package wires ESLint into the Angular CLI so you can run ng lint. Here's how it fits your build and where the supply-chain risk actually lives.
eslint-plugin-security: How to Catch Node.js Security Bugs at Lint Time
eslint-plugin-security adds static-analysis rules to ESLint that flag risky Node.js patterns before they ship. Here is how to configure it and read its warnings without drowning in noise.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.