eslint
An AST-based pattern checker for JavaScript.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/util/unicode/is-combining-character.js | AI (source-diff): Generated Unicode combining character data file — a dense integer array, not obfuscated malware. Explicitly labeled as auto-generated by tools/update-unicode-utils.js. Stable false positive for ESLint. | ai | |
| source-diff | net-exec-file:lib/util/ast-utils.js | AI (source-diff): lib/util/ast-utils.js is a core ESLint AST utility file with no actual network calls or malicious code execution — only standard require() and AST pattern matching. False positive for this package. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): handlebars ^4.0.0 is a stable, widely-used template engine; appropriate for eslint's config generation. | ai | |
| source-diff | obfuscated-file:lib/util/patterns/letters.js | AI (source-diff): File is a machine-generated Unicode letter regex using the `regenerate` library, explicitly documented as such in the file header. Long lines are inherent to this generation approach, not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): ivolodin (Ilya Volodin) is a long-standing ESLint core team member with 181 approved packages. Multi-maintainer releases are normal for the ESLint project. | ai | |
| provenance | missing-githead | AI (provenance): eslint 2.0.0 is a major release from the canonical publisher; missing gitHead is consistent with a changed publish workflow for a major version and is not a malware signal for this well-established package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is legitimately used in config-initializer for CLI tool initialization; stable pattern for eslint. | ai | |
| phantom-deps | phantom-dep:estraverse | AI (phantom-deps): estraverse is explicitly declared as a runtime dependency in package.json; the phantom-dep finding is a false positive for this package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): ESLint is a large, actively developed linting tool. Early versions grew rapidly as rules and infrastructure were added. Size increases reflect legitimate feature growth, not injected payloads. | ai | |
| dependencies | unvetted-dep:cssauron-esprima | AI (dependencies): cssauron-esprima is a small, specialized esprima wrapper; pinned to 0.0.1 and appropriate for eslint's AST analysis needs. | ai | |
| source-diff | net-exec-file:lib/types/rules.d.ts | AI (source-diff): lib/types/rules.d.ts is a TypeScript declaration file with only type definitions; no actual network calls or code execution. The analyzer false-positived on type signatures in a .d.ts file. | ai | |
| source-diff | obfuscated-file:lib/rules/utils/patterns/letters.js | AI (source-diff): Generated Unicode regex pattern with documented provenance from JSCS/regenerate tooling; long lines are the pattern itself, not obfuscation. | ai | |
| phantom-deps | phantom-dep:@types/json-schema | AI (phantom-deps): TypeScript type packages are loaded by convention; acceptable for a tool providing type definitions. | ai | |
| source-diff | net-exec-file:lib/types/rules/best-practices.d.ts | AI (source-diff): File is a TypeScript definition extracted from @types/eslint; contains only type declarations and MIT license header, no executable code or network calls. | ai | |
| dependencies | unvetted-dep:@nodelib/fs.walk | AI (dependencies): Established filesystem utility; appropriate for eslint's file-walking operations. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): OpenJS Foundation addition reflects ESLint's documented governance transition; legitimate organizational change. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of prior maintainers is consistent with OpenJS Foundation takeover; not a compromise signal. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 75 new source files expected for a v7→v10 major version jump including new flat config system, TypeScript types, and rule refactoring. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Apparent dormancy is an artifact of the registry's last approved version being v7.32.0; ESLint published v8.x and v9.x continuously. Not actual inactivity. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @eslint/config-array is an internal eslint package; new dependency is legitimate for this major version. | ai | |
| phantom-deps | phantom-dep:import-fresh | AI (phantom-deps): Normal pattern for config loaders; referenced in config files, not directly imported. | ai | |
| phantom-deps | phantom-dep:strip-json-comments | AI (phantom-deps): Normal pattern for config loaders; referenced in config files, not directly imported. | ai | |
| dependencies | unvetted-dep:v8-compile-cache | AI (dependencies): v8-compile-cache is a well-known performance optimization package used by eslint; legitimate and stable dependency. | ai | |
| dependencies | unvetted-dep:@eslint/eslintrc | AI (dependencies): @eslint/eslintrc is an official eslint org package for config handling; legitimate and stable dependency. | ai | |
| dependencies | unvetted-dep:eslint-utils | AI (dependencies): eslint-utils is a core eslint ecosystem utility package; legitimate and stable dependency. | ai | |
| dependencies | unvetted-dep:regexpp | AI (dependencies): regexpp is a well-known regex parser used by eslint for rule analysis; legitimate and stable dependency. | ai | |
| dependencies | unvetted-dep:table | AI (dependencies): table is a well-known, legitimate runtime dependency of eslint used for formatting output; stable across eslint versions. | ai | |
| dependencies | unvetted-dep:functional-red-black-tree | AI (dependencies): functional-red-black-tree is a well-known data structure package used by eslint; legitimate and stable dependency. | ai | |
| dependencies | unvetted-dep:@humanwhocodes/config-array | AI (dependencies): @humanwhocodes/config-array is authored by eslint's creator Nicholas Zakas and is a legitimate eslint dependency; stable for this package. | ai | |
| phantom-deps | phantom-dep:@types/estree | AI (phantom-deps): TypeScript type packages are loaded by convention; acceptable for a tool providing type definitions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads internal message templates from fixed directory; template name from error objects, not user input. | ai | |
| provenance | no-provenance | AI (provenance): ESLint is a well-established package with a known publisher and repository. Lack of Sigstore provenance is not a meaningful risk signal here. | ai |
Versions (showing 51 of 356)
| Version | Deps | Published |
|---|---|---|
| 10.4.1 | 30 / 58 | |
| 10.4.0 | 30 / 58 | |
| 10.3.0 | 30 / 59 | |
| 10.2.1 | 30 / 59 | |
| 10.2.0 | 30 / 59 | |
| 10.1.0 | 30 / 59 | |
| 10.0.3 | 30 / 59 | |
| 10.0.2 | 30 / 59 | |
| 10.0.1 | 30 / 59 | |
| 10.0.0 | 30 / 59 | |
| 9.39.4 | 34 / 61 | |
| 9.39.3 | 34 / 61 | |
| 9.39.2 | 34 / 61 | |
| 9.39.1 | 34 / 61 | |
| 9.39.0 | 34 / 61 | |
| 9.38.0 | 34 / 61 | |
| 9.37.0 | 35 / 61 | |
| 9.36.0 | 35 / 61 | |
| 9.35.0 | 35 / 61 | |
| 9.34.0 | 35 / 61 | |
| 9.33.0 | 35 / 61 | |
| 9.32.0 | 35 / 61 | |
| 9.31.0 | 35 / 62 | |
| 9.30.1 | 35 / 62 | |
| 9.30.0 | 35 / 62 | |
| 9.29.0 | 35 / 62 | |
| 9.28.0 | 35 / 62 | |
| 9.27.0 | 35 / 60 | |
| 9.26.0 | 37 / 60 | |
| 9.25.1 | 35 / 59 | |
| 9.25.0 | 35 / 59 | |
| 9.24.0 | 35 / 59 | |
| 9.23.0 | 35 / 59 | |
| 9.22.0 | 35 / 63 | |
| 9.21.0 | 34 / 63 | |
| 9.20.1 | 34 / 63 | |
| 9.20.0 | 34 / 63 | |
| 9.19.0 | 34 / 63 | |
| 9.18.0 | 34 / 63 | |
| 9.17.0 | 34 / 63 | |
| 9.16.0 | 34 / 63 | |
| 9.15.0 | 34 / 63 | |
| 9.14.0 | 35 / 63 | |
| 9.13.0 | 35 / 63 | |
| 9.12.0 | 35 / 63 | |
| 9.11.1 | 37 / 62 | |
| 9.11.0 | 34 / 65 | |
| 9.10.0 | 34 / 63 | |
| 9.9.1 | 34 / 62 | |
| 9.9.0 | 34 / 63 | |
| 9.8.0 | 34 / 62 |
v10.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.39.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.39.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.39.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.39.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.39.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.38.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.37.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.36.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.35.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.34.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.33.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.32.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.31.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.30.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.30.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.29.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.28.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.27.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.26.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.25.1
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.25.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.24.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.23.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.22.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.21.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.20.1
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.20.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.19.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.18.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.17.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.16.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.14.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.13.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.12.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.11.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.9.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.