eslint-config-wikimedia

ESLint config following Wikimedia code conventions.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

krinklejdforresteredg2scatropesanthosh.thottingalcscottsubbu_ssarlolrajdlrobsonmateusbs17brightbytephuedxjandre3000sbassett29nikerabbittchin25jgiannelos-wmfegardneranneteeottomatamvolzlwatz16volker_e

Keywords

style guideeslinteslintconfigwikimedia

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:eslint-plugin-json-es	AI (dependencies): Legitimate ESLint plugin dependency for a Wikimedia ESLint config; stable pattern across versions.	ai	2026/05/30
dependencies	unvetted-dep:browserslist-config-wikimedia	AI (dependencies): First-party Wikimedia browserslist config; expected dependency for this package.	ai	2026/05/30
provenance	no-provenance	AI (provenance): Established Wikimedia org package; lack of provenance is common and not a risk signal here.	ai	2026/05/14
phantom-deps	phantom-dep:eslint-plugin-vue	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-yml	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-es-x	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-jest	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-wdio	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-jsdoc	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-mocha	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-qunit	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-compat	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-json-es	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-unicorn	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-security	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-mediawiki	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-no-jquery	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:@stylistic/eslint-plugin	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:@typescript-eslint/parser	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:@typescript-eslint/eslint-plugin	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint-plugin-n	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:eslint	AI (phantom-deps): ESLint config package; plugins referenced in JSON configs, not imported directly — stable FP for this package.	ai	2026/05/12

Versions (showing 7 of 7)

Version	Deps	Published
0.32.4	19 / 3	2026-05-03
0.32.3	20 / 3	2025-12-01
0.32.2	20 / 3	2025-11-18
0.32.1	20 / 3	2025-11-13
0.32.0	20 / 3	2025-11-10
0.31.0	20 / 3	2025-07-25
0.30.0	17 / 3	2025-05-23

v0.32.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.32.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.32.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.