eslint-plugin-n
Additional ESLint's rules for Node.js
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from human publisher to GitHub Actions CI/CD with SLSA provenance; legitimate automation change. | ai | |
| phantom-deps | phantom-dep:builtins | AI (phantom-deps): builtins is correctly declared as a dependency and used as documented; phantom-dep finding is a false positive for this package's pattern. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): enhanced-resolve is a well-known webpack resolver package; it replaces several smaller deps (builtins, is-builtin-module, is-core-module, resolve) as a legitimate refactor for this ESLint plugin. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version release (16.x→17.x) of an established ESLint plugin; large number of new source files is consistent with significant feature work, not injected malicious code. | ai | |
| dependencies | unvetted-dep:get-tsconfig | AI (dependencies): get-tsconfig is a legitimate utility for resolving tsconfig files; its use in an ESLint plugin with TypeScript support is expected and appropriate. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in process-exit-as-throw.js iterates a controlled list of module names to load optional dependencies — standard ESLint plugin pattern, not arbitrary code execution. | ai |
Versions (showing 73 of 73)
| Version | Deps | Published |
|---|---|---|
| 18.0.1 | 8 / 30 | |
| 18.0.0 | 8 / 30 | |
| 17.24.0 | 9 / 27 | |
| 17.23.2 | 9 / 27 | |
| 17.23.1 | 9 / 27 | |
| 17.23.0 | 9 / 27 | |
| 17.22.0 | 9 / 27 | |
| 17.21.3 | 9 / 27 | |
| 17.21.2 | 9 / 27 | |
| 17.21.1 | 10 / 27 | |
| 17.21.0 | 9 / 26 | |
| 17.20.0 | 10 / 26 | |
| 17.19.0 | 10 / 26 | |
| 17.18.0 | 8 / 26 | |
| 17.17.0 | 8 / 26 | |
| 17.16.2 | 8 / 26 | |
| 17.16.1 | 10 / 26 | |
| 17.15.1 | 8 / 26 | |
| 17.15.0 | 8 / 26 | |
| 17.14.0 | 8 / 26 | |
| 17.13.2 | 8 / 26 | |
| 17.13.1 | 8 / 26 | |
| 17.13.0 | 8 / 26 | |
| 17.12.0 | 8 / 26 | |
| 17.11.1 | 8 / 26 | |
| 17.11.0 | 8 / 26 | |
| 17.10.3 | 8 / 26 | |
| 17.10.2 | 8 / 26 | |
| 17.10.1 | 8 / 26 | |
| 17.10.0 | 8 / 26 | |
| 17.9.0 | 8 / 26 | |
| 17.8.1 | 8 / 26 | |
| 17.8.0 | 8 / 26 | |
| 17.7.0 | 8 / 26 | |
| 17.6.0 | 8 / 26 | |
| 17.5.1 | 8 / 26 | |
| 17.5.0 | 8 / 26 | |
| 17.4.0 | 8 / 26 | |
| 17.3.0 | 8 / 26 | |
| 17.2.1 | 8 / 26 | |
| 17.2.0 | 8 / 26 | |
| 17.1.0 | 8 / 26 | |
| 17.0.0 | 9 / 26 | |
| 16.6.2 | 11 / 23 | |
| 16.6.1 | 11 / 23 | |
| 16.6.0 | 11 / 23 | |
| 16.5.0 | 10 / 24 | |
| 16.4.0 | 10 / 24 | |
| 16.3.1 | 10 / 24 | |
| 16.3.0 | 9 / 24 | |
| 16.2.0 | 9 / 24 | |
| 16.1.0 | 9 / 26 | |
| 16.0.2 | 8 / 25 | |
| 16.0.1 | 8 / 25 | |
| 16.0.0 | 8 / 25 | |
| 15.7.0 | 8 / 23 | |
| 15.6.1 | 8 / 21 | |
| 15.6.0 | 8 / 21 | |
| 15.5.2 | 8 / 21 | |
| 15.5.1 | 8 / 20 | |
| 15.5.0 | 8 / 20 | |
| 15.4.0 | 8 / 18 | |
| 15.3.0 | 8 / 18 | |
| 15.2.5 | 8 / 18 | |
| 15.2.4 | 8 / 18 | |
| 15.2.3 | 8 / 18 | |
| 15.2.2 | 8 / 18 | |
| 15.2.1 | 8 / 18 | |
| 15.2.0 | 8 / 19 | |
| 15.1.0 | 8 / 19 | |
| 15.0.1 | 8 / 19 | |
| 15.0.0 | 7 / 19 | |
| 14.0.0 | 7 / 13 |
v18.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v18.0.0
2 findingsThis version was published by a different npm account than previous versions on 2026-05-05. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.23.2
2 findingsThis version was published by a different npm account than previous versions on 2026-01-13. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.23.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.23.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.22.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.21.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.21.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.21.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.21.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.20.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.19.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.18.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.17.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.16.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.16.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.15.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.15.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.14.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.13.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.13.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.13.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.12.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.11.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.11.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.10.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.10.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.10.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.8.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.5.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v17.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.