Summary
Togoder Security scanned the npm package @typescript-eslint/eslint-plugin@8.70.0 on Oct 6, 2026. An AI review of 232 source files produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
0
critical
0
high
0
medium
1
low
Findings 1
low
Top-level code execution
NPS-A712490666D8
The file executes TypeScript version check at module load time, logging an error and throwing if versionMajor >= 7. This is normal version gating for typescript-eslint compatibility, not malicious behavior.
dist/index.js:36
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/configs/eslint-recommended-raw.js | safe | No malicious patterns detected; the file only exports a static ESLint configuration object with no network, filesystem, credential, or execution-related behavior. |
| dist/configs/eslintrc/all.js | safe | This file is a static ESLint configuration for typescript-eslint with no executable code, network access, or malicious patterns. |
| dist/configs/eslintrc/base.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/configs/eslintrc/disable-type-checked.js | safe | No malicious patterns detected |
| dist/configs/eslintrc/eslint-recommended.js | safe | No malicious patterns detected |
| dist/configs/eslintrc/recommended-type-checked-only.js | safe | This is a static ESLint configuration file generated by typescript-eslint that only exports rule definitions with no executable, network, filesystem, or dynamic code patterns. |
| dist/configs/eslintrc/recommended-type-checked.js | safe | This is a standard ESLint configuration file from typescript-eslint with no malicious patterns detected. |
| dist/configs/eslintrc/recommended.js | safe | No malicious patterns detected; this is a standard ESLint configuration file for typescript-eslint with only rule definitions and static configuration references. |
| dist/configs/eslintrc/strict-type-checked-only.js | safe | This is a static ESLint configuration file from the typescript-eslint monorepo containing only rule definitions, with no executable code, network calls, file system access, or other malicious patterns. |
| dist/configs/eslintrc/strict-type-checked.js | safe | No malicious patterns detected |
| dist/configs/eslintrc/strict.js | safe | No malicious patterns detected |
| dist/configs/eslintrc/stylistic-type-checked-only.js | safe | This is a static ESLint configuration file generated by typescript-eslint with no executable code, network access, or malicious patterns. |
| dist/configs/eslintrc/stylistic-type-checked.js | safe | No malicious patterns detected; the file is a standard auto-generated ESLint configuration with no executable code beyond a module.exports object of rule settings. |
| dist/configs/eslintrc/stylistic.js | safe | No malicious patterns detected |
| dist/configs/flat/all.js | safe | No malicious patterns detected; this is an auto-generated typescript-eslint flat config file that only defines ESLint rule settings and imports local config modules. |
| dist/configs/flat/base.js | safe | No malicious patterns detected |
| dist/configs/flat/disable-type-checked.js | safe | No malicious patterns detected |
| dist/configs/flat/eslint-recommended.js | safe | No malicious patterns detected; the file is a benign TypeScript-ESLint compatibility configuration that imports a local ruleset and exports a function. |
| dist/configs/flat/recommended-type-checked-only.js | safe | No malicious patterns detected; this is a standard typescript-eslint configuration file that only defines linting rules. |
| dist/configs/flat/recommended-type-checked.js | safe | No malicious patterns detected |
| dist/configs/flat/recommended.js | safe | This is a standard auto-generated ESLint config file from the typescript-eslint package that exports a function to configure recommended rules, with no malicious patterns detected. |
| dist/configs/flat/strict-type-checked-only.js | safe | This is a standard auto-generated typescript-eslint configuration file containing only rule definitions with no malicious patterns detected. |
| dist/configs/flat/strict-type-checked.js | safe | This is a benign TypeScript-ESLint configuration file with no malicious patterns detected. |
| dist/configs/flat/strict.js | safe | No malicious patterns detected |
| dist/configs/flat/stylistic-type-checked-only.js | safe | No malicious patterns detected; the file is a benign, auto-generated TypeScript-ESLint flat config exporting rule definitions and importing local base configurations. |
Show 207 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/configs/flat/stylistic-type-checked.js | safe | No malicious patterns detected; this is a benign TypeScript-ESLint configuration file that only imports local modules and exports rule definitions. |
| dist/configs/flat/stylistic.js | safe | No malicious patterns detected; the file is a benign, auto-generated typescript-eslint flat config that only imports local modules and defines lint rules. |
| dist/index.js | safe | No malicious patterns detected; the code performs a legitimate TypeScript version compatibility check and re-exports the plugin from a local module. |
| dist/raw-plugin.js | safe | This is a legitimate TypeScript ESLint plugin entry point that imports configuration modules and exports plugin objects without any malicious or suspicious patterns. |
| dist/rules/adjacent-overload-signatures.js | safe | No malicious patterns detected |
| dist/rules/array-type.js | safe | No malicious patterns detected; the file is a standard TypeScript ESLint rule implementation for enforcing array type consistency. |
| dist/rules/await-thenable.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns, network calls, credential harvesting, or dynamic code execution. |
| dist/rules/ban-ts-comment.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for banning TypeScript directives. |
| dist/rules/ban-tslint-comment.js | safe | No malicious patterns detected |
| dist/rules/class-literal-property-style.js | safe | This is a standard ESLint rule implementation for TypeScript class literal property style with no malicious patterns, network calls, or code execution. |
| dist/rules/class-methods-use-this.js | safe | This is a standard ESLint rule implementation for enforcing class methods to use 'this', with no malicious patterns detected. |
| dist/rules/consistent-generic-constructors.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule implementation with no network, filesystem, process, or dynamic code execution behavior. |
| dist/rules/consistent-indexed-object-style.js | safe | No malicious patterns detected; this is a standard TypeScript-ESLint rule implementation with no network, filesystem, process, or credential-access behavior. |
| dist/rules/consistent-return.js | safe | No malicious patterns detected; the code is a standard ESLint rule implementation using TypeScript utilities with no network, filesystem, process, or obfuscation concerns. |
| dist/rules/consistent-type-assertions.js | safe | No malicious patterns detected; the file is a standard TypeScript-ESLint rule implementation with no network, filesystem, process execution, or obfuscated payloads. |
| dist/rules/consistent-type-definitions.js | safe | No malicious patterns detected; this is a standard typescript-eslint rule implementation for consistent type definitions with no network, filesystem, process, or dynamic execution activity. |
| dist/rules/consistent-type-exports.js | safe | No malicious patterns detected; the file is a standard TypeScript ESLint rule for consistent type exports. |
| dist/rules/consistent-type-imports.js | safe | This is a legitimate ESLint rule from typescript-eslint that enforces consistent type imports and contains no malicious patterns. |
| dist/rules/default-param-last.js | safe | No malicious patterns detected |
| dist/rules/dot-notation.js | safe | This is a legitimate TypeScript ESLint rule implementation (dot-notation) with standard TypeScript compiler helper functions and no malicious patterns detected. |
| dist/rules/enum-utils/shared.js | safe | No malicious patterns detected |
| dist/rules/explicit-function-return-type.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule implementation with no network, filesystem, process, or dynamic code execution activity. |
| dist/rules/explicit-member-accessibility.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns, no network activity, no credential harvesting, and no dynamic code execution. |
| dist/rules/explicit-module-boundary-types.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule implementation with no network, filesystem, or code execution concerns. |
| dist/rules/index.js | safe | No malicious patterns detected; the file is a standard ESLint rule registry that statically imports and exports rule modules. |
| dist/rules/init-declarations.js | safe | No malicious patterns detected |
| dist/rules/max-params.js | safe | No malicious patterns detected |
| dist/rules/member-ordering.js | safe | No malicious patterns detected; this is a legitimate ESLint rule implementation for enforcing TypeScript member ordering. |
| dist/rules/method-signature-style.js | safe | No malicious patterns detected |
| dist/rules/naming-convention-utils/enums.js | safe | The file contains only TypeScript enum definitions for naming convention rules, with no malicious patterns detected. |
| dist/rules/naming-convention-utils/format.js | safe | No malicious patterns detected; this is a pure naming-convention utility module with only string validation logic and no network, filesystem, process, or dynamic code execution. |
| dist/rules/naming-convention-utils/index.js | safe | This is a standard TypeScript-generated re-export barrel file with no executable logic, network calls, filesystem access, or obfuscated code. |
| dist/rules/naming-convention-utils/parse-options.js | safe | No malicious patterns detected; the code is a standard ESLint naming-convention option parser with no network, filesystem, process, or dynamic-evaluation activity. |
| dist/rules/naming-convention-utils/schema.js | safe | This file defines JSON schema objects for a naming-convention lint rule and contains no network, filesystem, process, or dynamic execution activity. |
| dist/rules/naming-convention-utils/shared.js | safe | No malicious patterns detected |
| dist/rules/naming-convention-utils/types.js | safe | No malicious patterns detected |
| dist/rules/naming-convention-utils/validator.js | safe | No malicious patterns detected; the code is a standard TypeScript ESLint naming-convention validator with no network, filesystem, process, or dynamic execution activities. |
| dist/rules/naming-convention.js | safe | No malicious patterns detected; the code is a legitimate ESLint rule for enforcing naming conventions. |
| dist/rules/no-array-constructor.js | safe | No malicious patterns detected |
| dist/rules/no-array-delete.js | safe | No malicious patterns detected |
| dist/rules/no-base-to-string.js | safe | No malicious patterns detected; the file is a legitimate TypeScript ESLint rule implementation for no-base-to-string. |
| dist/rules/no-confusing-non-null-assertion.js | safe | This is a legitimate ESLint rule from @typescript-eslint that flags confusing non-null assertion usage; no malicious patterns detected. |
| dist/rules/no-confusing-void-expression.js | safe | No malicious patterns detected; this is a legitimate TypeScript ESLint rule implementation with standard helper bindings and no network, filesystem, process, or obfuscated code. |
| dist/rules/no-deprecated.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule implementation for disallowing deprecated code. |
| dist/rules/no-dupe-class-members.js | safe | No malicious patterns detected; code is a standard ESLint rule extension for TypeScript class member checking. |
| dist/rules/no-duplicate-enum-values.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for TypeScript enums. |
| dist/rules/no-duplicate-type-constituents.js | safe | This is a legitimate ESLint rule implementation from @typescript-eslint/eslint-plugin with no malicious patterns detected. |
| dist/rules/no-dynamic-delete.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation from @typescript-eslint with no suspicious behavior. |
| dist/rules/no-empty-function.js | safe | No malicious patterns detected |
| dist/rules/no-empty-interface.js | safe | No malicious patterns detected |
| dist/rules/no-empty-object-type.js | safe | This is a legitimate ESLint rule implementation from @typescript-eslint that contains no malicious patterns; it only performs static code analysis and fixes for TypeScript type declarations. |
| dist/rules/no-explicit-any.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for disallowing the TypeScript any type. |
| dist/rules/no-extra-non-null-assertion.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for disallowing extra non-null assertions. |
| dist/rules/no-extraneous-class.js | safe | This is a standard ESLint rule implementation from typescript-eslint with no malicious patterns, network access, file system manipulation, or dynamic code execution. |
| dist/rules/no-floating-promises.js | safe | No malicious patterns detected; this is a legitimate ESLint rule implementation from @typescript-eslint with no data exfiltration, credential harvesting, or dynamic code execution. |
| dist/rules/no-for-in-array.js | safe | No malicious patterns detected; this is a standard ESLint rule module for detecting for-in loops over arrays. |
| dist/rules/no-generated-empty-object-type.js | safe | This is a standard TypeScript ESLint rule implementation with no malicious patterns, network activity, credential access, or dynamic code execution. |
| dist/rules/no-implied-eval.js | safe | This is a legitimate ESLint rule implementation from @typescript-eslint that detects implied eval usage; no malicious patterns, network activity, file system access, or process spawning were found. |
| dist/rules/no-import-type-side-effects.js | safe | This is a legitimate ESLint rule implementation from @typescript-eslint/eslint-plugin that contains no malicious patterns. |
| dist/rules/no-inferrable-types.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns detected. |
| dist/rules/no-invalid-this.js | safe | No malicious patterns detected |
| dist/rules/no-invalid-void-type.js | safe | This is a standard ESLint rule implementation for TypeScript void type validation with no malicious patterns detected. |
| dist/rules/no-loop-func.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for disallowing function declarations in loops with references to unsafe variables. |
| dist/rules/no-loss-of-precision.js | safe | No malicious patterns detected; this is a standard ESLint rule deprecation wrapper that delegates to the core rule. |
| dist/rules/no-magic-numbers.js | safe | No malicious patterns detected |
| dist/rules/no-meaningless-void-operator.js | safe | No malicious patterns detected |
| dist/rules/no-misused-new.js | safe | No malicious patterns detected; the file is a standard ESLint rule implementation for TypeScript without any security concerns. |
| dist/rules/no-misused-promises.js | safe | This is a standard TypeScript ESLint rule implementation for detecting misused promises; it contains no malicious patterns, no network or filesystem access, no dynamic code execution, and no credential harvesting. |
| dist/rules/no-misused-spread.js | safe | This is a legitimate TypeScript-ESLint lint rule implementation with no malicious patterns detected. |
| dist/rules/no-mixed-enums.js | safe | This is a standard TypeScript ESLint rule implementation for detecting mixed enums, with no malicious patterns, network activity, credential access, or suspicious code execution. |
| dist/rules/no-namespace.js | safe | This is a standard ESLint rule definition from @typescript-eslint with no malicious patterns, network activity, file system access, or dynamic code execution. |
| dist/rules/no-non-null-asserted-nullish-coalescing.js | safe | This is a legitimate ESLint rule from typescript-eslint that checks for non-null assertions in nullish coalescing operators; no malicious patterns detected. |
| dist/rules/no-non-null-asserted-optional-chain.js | safe | This is a standard ESLint rule implementation for disallowing non-null assertions after optional chain expressions, with no malicious patterns detected. |
| dist/rules/no-non-null-assertion.js | safe | No malicious patterns detected; the file is a legitimate ESLint rule implementation for TypeScript. |
| dist/rules/no-redeclare.js | safe | This is a standard ESLint rule implementation for no-redeclare from @typescript-eslint, containing no malicious patterns, network activity, credential access, or dynamic code execution. |
| dist/rules/no-redundant-type-constituents.js | safe | No malicious patterns detected; the file is a legitimate TypeScript ESLint rule implementation without network, filesystem, process, or obfuscated code activity. |
| dist/rules/no-require-imports.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule for disallowing require() imports. |
| dist/rules/no-restricted-imports.js | safe | This is a legitimate TypeScript ESLint rule implementation for no-restricted-imports with no malicious patterns detected. |
| dist/rules/no-restricted-types.js | safe | No malicious patterns detected |
| dist/rules/no-shadow.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for TypeScript from @typescript-eslint. |
| dist/rules/no-this-alias.js | safe | No malicious patterns detected |
| dist/rules/no-type-alias.js | safe | No malicious patterns detected; the file is a standard TypeScript ESLint rule implementation with no network, filesystem, process, or dynamic execution activity. |
| dist/rules/no-unnecessary-boolean-literal-compare.js | safe | This is a standard TypeScript ESLint rule implementation for detecting unnecessary boolean literal comparisons, with no malicious patterns detected. |
| dist/rules/no-unnecessary-condition.js | safe | No malicious patterns detected |
| dist/rules/no-unnecessary-parameter-property-assignment.js | safe | No malicious patterns detected; the code is a standard ESLint rule implementation for detecting unnecessary parameter property assignments. |
| dist/rules/no-unnecessary-qualifier.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns detected. |
| dist/rules/no-unnecessary-template-expression.js | safe | This is a legitimate ESLint rule from typescript-eslint that performs static analysis on template literals with no malicious patterns. |
| dist/rules/no-unnecessary-type-arguments.js | safe | No malicious patterns detected; the file is a standard TypeScript-ESLint rule implementation for no-unnecessary-type-arguments with only normal imports and helper functions. |
| dist/rules/no-unnecessary-type-assertion.js | safe | This file is a standard TypeScript ESLint rule implementation (no-unnecessary-type-assertion) containing only AST analysis logic, with no malicious patterns such as network calls, credential harvesting, obfuscation, or process execution. |
| dist/rules/no-unnecessary-type-constraint.js | safe | This is a standard ESLint rule from @typescript-eslint that only performs AST analysis for detecting unnecessary type constraints, with no malicious patterns or security concerns. |
| dist/rules/no-unnecessary-type-conversion.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns; it only performs static analysis using standard AST utilities and TypeScript type checking. |
| dist/rules/no-unnecessary-type-parameters.js | safe | This is a legitimate TypeScript ESLint rule implementation for detecting unnecessary type parameters; no malicious patterns were found. |
| dist/rules/no-unsafe-argument.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule implementation. |
| dist/rules/no-unsafe-assignment.js | safe | This is a legitimate TypeScript ESLint rule implementation for detecting unsafe any assignments; no malicious patterns were detected. |
| dist/rules/no-unsafe-call.js | safe | This is a standard ESLint rule implementation using TypeScript helpers with no malicious patterns, network calls, credential harvesting, or dynamic code execution. |
| dist/rules/no-unsafe-declaration-merging.js | safe | No malicious patterns detected; this is a legitimate ESLint rule from @typescript-eslint that checks for unsafe declaration merging. |
| dist/rules/no-unsafe-enum-comparison.js | safe | No malicious patterns detected |
| dist/rules/no-unsafe-function-type.js | safe | No malicious patterns detected; this is a benign TypeScript ESLint rule implementation. |
| dist/rules/no-unsafe-member-access.js | safe | No malicious patterns detected |
| dist/rules/no-unsafe-return.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns, network activity, file system access, or code execution. |
| dist/rules/no-unsafe-type-assertion.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for TypeScript type assertion safety with no network, filesystem, process, or dynamic code execution behavior. |
| dist/rules/no-unsafe-unary-minus.js | safe | No malicious patterns detected; this is a standard TypeScript/ESLint rule implementation for validating unary minus operands with no network, filesystem, process, or dynamic execution behavior. |
| dist/rules/no-unused-expressions.js | safe | No malicious patterns detected; the file is a legitimate ESLint rule implementation for disallowing unused expressions. |
| dist/rules/no-unused-private-class-members.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns detected; it only performs static analysis of class member usage. |
| dist/rules/no-unused-vars.js | safe | This is a legitimate TypeScript ESLint rule implementation for detecting unused variables, with no malicious patterns detected. |
| dist/rules/no-use-before-define.js | safe | No malicious patterns detected; the file is a standard ESLint rule implementation for @typescript-eslint with no network, filesystem, process, or dynamic code execution behavior. |
| dist/rules/no-useless-constructor.js | safe | No malicious patterns detected |
| dist/rules/no-useless-default-assignment.js | safe | No malicious patterns detected; this is a standard ESLint rule for TypeScript with no network, filesystem, process, or dynamic code execution activity. |
| dist/rules/no-useless-empty-export.js | safe | No malicious patterns detected; the code is a standard ESLint rule implementation for TypeScript with no network, filesystem, process, or dynamic execution behavior. |
| dist/rules/no-var-requires.js | safe | No malicious patterns detected |
| dist/rules/no-wrapper-object-types.js | safe | This is a legitimate ESLint rule implementation from typescript-eslint that contains no malicious patterns, network requests, credential harvesting, or suspicious behavior. |
| dist/rules/non-nullable-type-assertion-style.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns detected. |
| dist/rules/only-throw-error.js | safe | This is a standard ESLint rule implementation from @typescript-eslint for checking thrown errors, with no malicious patterns, network activity, credential access, or dynamic code execution. |
| dist/rules/parameter-properties.js | safe | No malicious patterns detected |
| dist/rules/prefer-as-const.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule implementation. |
| dist/rules/prefer-destructuring.js | safe | This is a legitimate ESLint rule implementation from typescript-eslint that contains no malicious patterns such as data exfiltration, credential harvesting, obfuscated payloads, or process spawning. |
| dist/rules/prefer-enum-initializers.js | safe | No malicious patterns detected; this is a legitimate ESLint rule implementation for TypeScript enum initializers with no network, filesystem, process, or install-time behavior. |
| dist/rules/prefer-find.js | safe | No malicious patterns detected; the file is a standard TypeScript-ESLint rule implementation with no network, filesystem, process, or dynamic code execution behavior. |
| dist/rules/prefer-for-of.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation for TypeScript that performs purely static analysis of ForStatement AST nodes without any network, filesystem, process, or dynamic execution behavior. |
| dist/rules/prefer-function-type.js | safe | No malicious patterns detected; this is a legitimate ESLint rule implementation from @typescript-eslint. |
| dist/rules/prefer-includes.js | safe | No malicious patterns detected |
| dist/rules/prefer-literal-enum-member.js | safe | No malicious patterns detected; this is a standard TypeScript ESLint rule implementation for enforcing literal enum members. |
| dist/rules/prefer-namespace-keyword.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation from @typescript-eslint that only inspects AST nodes and reports code style suggestions. |
| dist/rules/prefer-nullish-coalescing.js | safe | No malicious patterns detected; the file is a standard TypeScript ESLint rule for enforcing nullish coalescing, with only expected utility imports and no exfiltration, execution, or filesystem abuse. |
| dist/rules/prefer-optional-chain-utils/PreferOptionalChainOptions.js | safe | No malicious patterns detected |
| dist/rules/prefer-optional-chain-utils/analyzeChain.js | safe | No malicious patterns detected; this is a legitimate typescript-eslint rule implementation for preferring optional chaining with no network, filesystem, process, or dynamic code execution behavior. |
| dist/rules/prefer-optional-chain-utils/checkNullishAndReport.js | safe | No malicious patterns detected; the file contains standard TypeScript/ESLint helper code for optional chaining nullish checks with no network, filesystem, process, or dynamic execution activity. |
| dist/rules/prefer-optional-chain-utils/compareNodes.js | safe | No malicious patterns detected; the code is a benign AST node comparison utility for typescript-eslint with no network, filesystem, process, or dynamic execution behavior. |
| dist/rules/prefer-optional-chain-utils/gatherLogicalOperands.js | safe | No malicious patterns detected; the file is a TypeScript-ESLint utility for analyzing logical operands without any network, filesystem, process, or dynamic code execution behavior. |
| dist/rules/prefer-optional-chain.js | safe | No malicious patterns detected |
| dist/rules/prefer-promise-reject-errors.js | safe | No malicious patterns detected; this is a legitimate ESLint rule implementation from @typescript-eslint. |
| dist/rules/prefer-readonly-parameter-types.js | safe | No malicious patterns detected |
| dist/rules/prefer-readonly.js | safe | No malicious patterns detected; the file is a standard TypeScript ESLint rule implementation with only benign require imports and AST analysis logic. |
| dist/rules/prefer-reduce-type-parameter.js | safe | No malicious patterns detected; the file is a standard ESLint rule implementation with TypeScript helper boilerplate, containing no network, filesystem, process, or dynamic execution behavior. |
| dist/rules/prefer-regexp-exec.js | safe | This is a standard ESLint rule implementation from @typescript-eslint that performs static analysis on regexp patterns with no malicious patterns, network activity, or code execution. |
| dist/rules/prefer-return-this-type.js | safe | No malicious patterns detected |
| dist/rules/prefer-string-starts-ends-with.js | safe | No malicious patterns detected; this is a legitimate ESLint rule implementation for the @typescript-eslint plugin. |
| dist/rules/prefer-ts-expect-error.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation from typescript-eslint that only manipulates source code comments for linting purposes. |
| dist/rules/promise-function-async.js | safe | This is a legitimate TypeScript ESLint rule implementation with no malicious patterns, network activity, or suspicious behavior. |
| dist/rules/related-getter-setter-pairs.js | safe | No malicious patterns detected; this is a legitimate TypeScript ESLint rule implementation for enforcing getter/setter type compatibility. |
| dist/rules/require-array-sort-compare.js | safe | This is a standard ESLint rule implementation with no malicious patterns, network calls, or suspicious behavior. |
| dist/rules/require-await.js | safe | No malicious patterns detected in this ESLint rule implementation for @typescript-eslint, which contains only standard TypeScript compilation helper functions and rule logic. |
| dist/rules/restrict-plus-operands.js | safe | No malicious patterns detected; the file is a standard ESLint rule implementation for restricting '+' operands with no network, filesystem, process, or dynamic execution activity. |
| dist/rules/restrict-template-expressions.js | safe | No malicious patterns detected |
| dist/rules/return-await.js | safe | No malicious patterns detected; this is a standard ESLint rule implementation from @typescript-eslint with no network, filesystem, process execution, or obfuscated code. |
| dist/rules/sort-type-constituents.js | safe | No malicious patterns detected |
| dist/rules/strict-boolean-expressions.js | safe | No malicious patterns detected; the file is a TypeScript ESLint rule implementation with standard TypeScript helper boilerplate and no network, filesystem, process, or dynamic code execution activity. |
| dist/rules/strict-void-return.js | safe | No malicious patterns detected; the file is a standard TypeScript ESLint rule implementation for enforcing void return types. |
| dist/rules/switch-exhaustiveness-check.js | safe | This is a legitimate TypeScript ESLint rule implementing switch exhaustiveness checking with no malicious patterns, network calls, credential harvesting, or dynamic code execution. |
| dist/rules/triple-slash-reference.js | safe | This is a standard ESLint rule implementation for @typescript-eslint that checks triple-slash reference directives, with no malicious patterns such as data exfiltration, credential harvesting, obfuscation, or unauthorized system access. |
| dist/rules/typedef.js | safe | No malicious patterns detected; this is a legitimate TypeScript ESLint typedef rule that only performs static AST analysis without network, filesystem, process, or dynamic code execution behavior. |
| dist/rules/unbound-method.js | safe | This is a legitimate TypeScript ESLint rule implementation for detecting unbound methods, with no malicious patterns such as data exfiltration, credential harvesting, dynamic code execution, or network activity. |
| dist/rules/unified-signatures.js | safe | No malicious patterns detected |
| dist/rules/use-unknown-in-catch-callback-variable.js | safe | No malicious patterns detected. |
| dist/util/FunctionSignature.js | safe | The file is standard TypeScript-ESLint helper code for analyzing function signatures; no malicious patterns were detected. |
| dist/util/assertionFunctionUtils.js | safe | No malicious patterns detected |
| dist/util/astUtils.js | safe | No malicious patterns detected; the file contains standard TypeScript/ESLint AST utility helpers with no network, filesystem, process, or dynamic execution behavior. |
| dist/util/baseTypeUtils.js | safe | No malicious patterns detected; the code is a standard TypeScript AST utility module with no network, filesystem, process, or obfuscation concerns. |
| dist/util/class-scope-analyzer/classScopeAnalyzer.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/util/class-scope-analyzer/extractComputedName.js | safe | No malicious patterns detected |
| dist/util/class-scope-analyzer/types.js | safe | No malicious patterns detected |
| dist/util/collectUnusedVariables.js | safe | No malicious patterns detected |
| dist/util/createRule.js | safe | No malicious patterns detected |
| dist/util/escapeRegExp.js | safe | The file is a straightforward implementation of Lodash's escapeRegExp utility with no malicious patterns, network activity, or dynamic code execution. |
| dist/util/explicitReturnTypeUtils.js | safe | No malicious patterns detected |
| dist/util/getBaseTypesOfClassMember.js | safe | No malicious patterns detected |
| dist/util/getConstraintInfo.js | safe | No malicious patterns detected; file contains standard TypeScript helper code for retrieving type constraint information. |
| dist/util/getESLintCoreRule.js | safe | No malicious patterns detected; the code only retrieves built-in ESLint rules via a supported API. |
| dist/util/getFixOrSuggest.js | safe | No malicious patterns detected; the code is a simple utility function with no network, filesystem, or dynamic execution behavior. |
| dist/util/getForStatementHeadLoc.js | safe | No malicious patterns detected; the code is a straightforward utility function for locating the head of a for statement in ESLint/TypeScript-ESLint rules. |
| dist/util/getFunctionHeadLoc.js | safe | No malicious patterns detected; the file is a pure AST utility for computing function head locations, with no network, filesystem, process, or dynamic code execution behavior. |
| dist/util/getMemberHeadLoc.js | safe | No malicious patterns detected; the file contains only pure utility functions for computing AST source locations for ESLint reporting. |
| dist/util/getOperatorPrecedence.js | safe | No malicious patterns detected; the file only contains operator precedence logic for TypeScript/JavaScript AST nodes. |
| dist/util/getParentFunctionNode.js | safe | No malicious patterns detected; the file is a benign utility that walks the AST parent chain to find the enclosing function node. |
| dist/util/getStaticStringValue.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/util/getStringLength.js | safe | No malicious patterns detected; the code is a simple string length utility using Intl.Segmenter with no network, filesystem, process execution, or obfuscation. |
| dist/util/getTextWithParentheses.js | safe | No malicious patterns detected; the code is a simple utility for extracting text with parentheses from AST nodes. |
| dist/util/getThisExpression.js | safe | No malicious patterns detected; the code is a benign utility function for traversing AST nodes to find a ThisExpression. |
| dist/util/getValueOfLiteralType.js | safe | The file contains only straightforward TypeScript compiler utility logic for converting pseudo-BigInt literal types, with no network, filesystem, process, eval, or obfuscation patterns. |
| dist/util/getWrappedCode.js | safe | No malicious patterns detected |
| dist/util/getWrappingFixer.js | safe | No malicious patterns detected |
| dist/util/hasOverloadSignatures.js | safe | No malicious patterns detected |
| dist/util/index.js | safe | No malicious patterns detected; the file contains standard TypeScript/ESLint utility re-exports and binding helpers with no network, filesystem, or dynamic execution activity. |
| dist/util/isArrayMethodCallWithPredicate.js | safe | No malicious patterns detected; the file contains only standard TypeScript ESLint utility code for type checking without network, filesystem, process, or dynamic execution behaviors. |
| dist/util/isAssignee.js | safe | No malicious patterns detected |
| dist/util/isConditionalTest.js | safe | No malicious patterns detected |
| dist/util/isHigherPrecedenceThanAwait.js | safe | No malicious patterns detected; the file contains standard TypeScript helper functions for operator precedence comparison with no network, filesystem, process, or credential access. |
| dist/util/isNodeEqual.js | safe | No malicious patterns detected; the file is a simple AST node comparison utility with no network, filesystem, or dynamic code execution behavior. |
| dist/util/isNullLiteral.js | safe | No malicious patterns detected |
| dist/util/isPromiseAggregatorMethod.js | safe | No malicious patterns detected; the file contains a benign ESLint utility function for detecting Promise aggregator method calls. |
| dist/util/isStartOfArrowFunctionBody.js | safe | No malicious patterns detected; the file contains a legitimate utility function for AST analysis without any security concerns. |
| dist/util/isStartOfExpressionStatement.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/util/isTypeImport.js | safe | No malicious patterns detected; the file contains only a pure utility function for TypeScript type import detection. |
| dist/util/isUndefinedIdentifier.js | safe | No malicious patterns detected; the file is a simple TypeScript-ESLint AST utility that checks for the identifier 'undefined'. |
| dist/util/misc.js | safe | This file contains standard TypeScript utility functions and helper methods with no malicious patterns, network activity, credential harvesting, or dynamic code execution. |
| dist/util/needsPrecedingSemiColon.js | safe | No malicious patterns detected; the file is a legitimate ESLint utility for semicolon insertion analysis with only static imports and pure AST logic. |
| dist/util/needsToBeAwaited.js | safe | No malicious patterns detected; the code is standard TypeScript helper output for a type-checking utility with no network, filesystem, process, or dynamic execution activity. |
| dist/util/objectIterators.js | safe | No malicious patterns detected; the file only provides simple key-iteration utility functions with no network, filesystem, process, or dynamic execution behavior. |
| dist/util/promiseUtils.js | safe | No malicious patterns detected; this is a static AST helper for parsing Promise method calls in a TypeScript ESLint plugin. |
| dist/util/rangeToLoc.js | safe | No malicious patterns detected |
| dist/util/referenceContainsTypePredicate.js | safe | No malicious patterns detected; the file contains a simple recursive AST utility function with no network, filesystem, process, or dynamic execution behavior. |
| dist/util/referenceContainsTypeQuery.js | safe | No malicious patterns detected; the file contains a simple recursive AST utility function with no risky behavior. |
| dist/util/scopeUtils.js | safe | No malicious patterns detected; the code only performs static scope analysis on an AST node. |
| dist/util/skipChainExpression.js | safe | No malicious patterns detected |
| dist/util/truthinessUtils.js | safe | No malicious patterns detected; the code is standard TypeScript compiler-generated helper code and truthiness utility functions. |
| dist/util/types.js | safe | No malicious patterns detected |
| dist/util/walkStatements.js | safe | No malicious patterns detected; the code is a pure AST traversal utility with no network, filesystem, process, or dynamic execution capabilities. |
Frequently asked questions
Is @typescript-eslint/eslint-plugin safe to use?
Our AI source review of @typescript-eslint/eslint-plugin@8.70.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does @typescript-eslint/eslint-plugin contain malware?
No malware was identified in @typescript-eslint/eslint-plugin@8.70.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @typescript-eslint/eslint-plugin checked?
Togoder Security downloaded the published npm package and had an AI model read its 232 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @typescript-eslint/eslint-plugin together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @typescript-eslint/eslint-plugin@8.70.0, cost nothing.