Summary
Togoder Security scanned the npm package eslint-plugin-react@7.37.5 on Oct 6, 2026. An AI review of 136 source files produced 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
0
critical
0
high
0
medium
3
low
Findings 3
low
File system access outside package scope
NPS-8BC1227E1251
fs.statSync() is called on filenames derived from ESLint context, which may point to arbitrary files in the user's project. This is used only to determine the base directory for module resolution and does not read file contents, so the risk is minimal.
lib/util/version.js:32
low
Dynamic module loading based on filesystem resolution
NPS-522F2089BE0A
The code uses resolve.sync() followed by require() with a dynamically computed path for the 'react' and 'flow-bin/package.json' packages based on the user's project directory. While this is a legitimate pattern for detecting installed package versions, dynamic require() of resolved modules can be abused if the resolution logic or basedir is influenced by untrusted input. In this specific context (an ESLint plugin detecting local React/Flow versions), the risk is low-to-medium.
lib/util/version.js:79
low
Dynamic module loading based on filesystem resolution
NPS-949B25439F91
Similar dynamic require() of flow-bin/package.json using a resolved path. Same low-risk legitimate use case.
lib/util/version.js:130
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/util/version.js | medium | The code performs dynamic require() of locally resolved 'react' and 'flow-bin' packages for version detection in an ESLint plugin context; no malicious patterns such as exfiltration, credential harvesting, obfuscation, or shell execution were found. |
| configs/all.js | safe | Cleared by Jev triage; no further analysis needed |
| configs/jsx-runtime.js | safe | Cleared by Jev triage; no further analysis needed |
| configs/recommended.js | safe | Cleared by Jev triage; no further analysis needed |
| index.js | safe | No malicious patterns detected; this is a standard ESLint plugin configuration file with no suspicious behavior. |
| lib/rules/boolean-prop-naming.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/button-has-type.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/checked-requires-onchange-or-readonly.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/default-props-match-prop-types.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/destructuring-assignment.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/display-name.js | safe | No malicious patterns detected |
| lib/rules/forbid-component-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/forbid-dom-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/forbid-elements.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/forbid-foreign-prop-types.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/forbid-prop-types.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/forward-ref-uses-ref.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/function-component-definition.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/hook-use-state.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/iframe-missing-sandbox.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/index.js | safe | No malicious patterns detected; the file is a standard ESLint plugin rule index that statically requires local rule modules. |
| lib/rules/jsx-boolean-value.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-child-element-spacing.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-closing-bracket-location.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-closing-tag-location.js | safe | Cleared by Jev triage; no further analysis needed |
Show 111 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/rules/jsx-curly-brace-presence.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-curly-newline.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-curly-spacing.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-equals-spacing.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-filename-extension.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-first-prop-new-line.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-fragments.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-handler-names.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-indent-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-indent.js | safe | This is a legitimate ESLint rule for JSX indentation with no malicious patterns detected; it performs only static code analysis and formatting fixes. |
| lib/rules/jsx-key.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-max-depth.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-max-props-per-line.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-newline.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-bind.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-comment-textnodes.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-constructed-context-values.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-duplicate-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-leaked-render.js | safe | No malicious patterns detected |
| lib/rules/jsx-no-literals.js | safe | No malicious patterns detected; the file is a benign ESLint rule implementation that does not perform any I/O, network, credential, or code-execution activities. |
| lib/rules/jsx-no-script-url.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-target-blank.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-undef.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-no-useless-fragment.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-one-expression-per-line.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-pascal-case.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-props-no-multi-spaces.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-props-no-spread-multi.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-props-no-spreading.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-sort-default-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-sort-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-space-before-closing.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-tag-spacing.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-uses-react.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-uses-vars.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/jsx-wrap-multilines.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-access-state-in-setstate.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-adjacent-inline-elements.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-array-index-key.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-arrow-function-lifecycle.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-children-prop.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-danger-with-children.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-danger.js | safe | No malicious patterns detected |
| lib/rules/no-deprecated.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-did-mount-set-state.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-did-update-set-state.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-direct-mutation-state.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-find-dom-node.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-invalid-html-attribute.js | safe | No malicious patterns detected; the file is a standard ESLint rule implementation for validating HTML 'rel' attributes with no network, filesystem, process, or dynamic code execution concerns. |
| lib/rules/no-is-mounted.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-multi-comp.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-namespace.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-object-type-as-default-prop.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-redundant-should-component-update.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-render-return-value.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-set-state.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-string-refs.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-this-in-sfc.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-typos.js | safe | No malicious patterns detected |
| lib/rules/no-unescaped-entities.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-unknown-property.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-unsafe.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-unstable-nested-components.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-unused-class-component-methods.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-unused-prop-types.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-unused-state.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/no-will-update-set-state.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/prefer-es6-class.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/prefer-exact-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/prefer-read-only-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/prefer-stateless-function.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/prop-types.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/react-in-jsx-scope.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/require-default-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/require-optimization.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/require-render-return.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/self-closing-comp.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/sort-comp.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/sort-default-props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/sort-prop-types.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/state-in-constructor.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/static-property-placement.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/style-prop-object.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/rules/void-dom-elements-no-children.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/Components.js | safe | No malicious patterns detected in this ESLint React component detection utility; it contains only AST analysis logic with no network, filesystem, process, or dynamic execution activity. |
| lib/util/annotations.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/ast.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/componentUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/defaultProps.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/docsUrl.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/error.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/eslint.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/getTokenBeforeClosingBracket.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/isCreateContext.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/isCreateElement.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/isDestructuredFromPragmaImport.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/isFirstLetterCapitalized.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/jsx.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/lifecycleMethods.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/linkComponents.js | safe | No malicious patterns detected |
| lib/util/log.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/makeNoMethodSetStateRule.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/message.js | safe | No malicious patterns detected; the code is a benign utility that conditionally returns message data based on ESLint version compatibility. |
| lib/util/pragma.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/propTypes.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/propTypesSort.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/propWrapper.js | safe | No malicious patterns detected |
| lib/util/props.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/report.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/usedPropTypes.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/util/variable.js | safe | Cleared by Jev triage; no further analysis needed |
Scanned versions of eslint-plugin-react
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 7.37.5 | Needs review | 136 | Oct 6, 2026 |
Frequently asked questions
Is eslint-plugin-react safe to use?
No confirmed malware was found in eslint-plugin-react@7.37.5, but the review flagged 3 low severity findings for risky patterns worth checking before you rely on it.
Does eslint-plugin-react contain malware?
No malware was identified in eslint-plugin-react@7.37.5 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was eslint-plugin-react checked?
Togoder Security downloaded the published npm package and had an AI model read its 136 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan eslint-plugin-react together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in eslint-plugin-react@7.37.5, cost nothing.