# eslint-plugin-react@7.37.5 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-06T14:16:30.000Z - Files reviewed: 136 - Findings: 3 low severity findings - Report: https://security.togoder.click/npm/eslint-plugin-react - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package eslint-plugin-react@7.37.5 on Oct 6, 2026. An AI review of 136 source files produced 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [low] File system access outside package scope Finding ID: `NPS-8BC1227E1251` File: `lib/util/version.js:32` fs.statSync() is called on filenames derived from ESLint context, which may point to arbitrary files in the user's project. This is used only to determine the base directory for module resolution and does not read file contents, so the risk is minimal. ### [low] Dynamic module loading based on filesystem resolution Finding ID: `NPS-522F2089BE0A` File: `lib/util/version.js:79` The code uses resolve.sync() followed by require() with a dynamically computed path for the 'react' and 'flow-bin/package.json' packages based on the user's project directory. While this is a legitimate pattern for detecting installed package versions, dynamic require() of resolved modules can be abused if the resolution logic or basedir is influenced by untrusted input. In this specific context (an ESLint plugin detecting local React/Flow versions), the risk is low-to-medium. ### [low] Dynamic module loading based on filesystem resolution Finding ID: `NPS-949B25439F91` File: `lib/util/version.js:130` Similar dynamic require() of flow-bin/package.json using a resolved path. Same low-risk legitimate use case. ## Files reviewed - `lib/util/version.js` (medium): The code performs dynamic require() of locally resolved 'react' and 'flow-bin' packages for version detection in an ESLint plugin context; no malicious patterns such as exfiltration, credential harvesting, obfuscation, or shell execution were found. - `configs/all.js` (safe): Cleared by Jev triage; no further analysis needed - `configs/jsx-runtime.js` (safe): Cleared by Jev triage; no further analysis needed - `configs/recommended.js` (safe): Cleared by Jev triage; no further analysis needed - `index.js` (safe): No malicious patterns detected; this is a standard ESLint plugin configuration file with no suspicious behavior. - `lib/rules/boolean-prop-naming.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/button-has-type.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/checked-requires-onchange-or-readonly.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/default-props-match-prop-types.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/destructuring-assignment.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/display-name.js` (safe): No malicious patterns detected - `lib/rules/forbid-component-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/forbid-dom-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/forbid-elements.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/forbid-foreign-prop-types.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/forbid-prop-types.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/forward-ref-uses-ref.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/function-component-definition.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/hook-use-state.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/iframe-missing-sandbox.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/index.js` (safe): No malicious patterns detected; the file is a standard ESLint plugin rule index that statically requires local rule modules. - `lib/rules/jsx-boolean-value.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-child-element-spacing.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-closing-bracket-location.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-closing-tag-location.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-curly-brace-presence.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-curly-newline.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-curly-spacing.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-equals-spacing.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-filename-extension.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-first-prop-new-line.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-fragments.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-handler-names.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-indent-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-indent.js` (safe): This is a legitimate ESLint rule for JSX indentation with no malicious patterns detected; it performs only static code analysis and formatting fixes. - `lib/rules/jsx-key.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-max-depth.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-max-props-per-line.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-newline.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-bind.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-comment-textnodes.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-constructed-context-values.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-duplicate-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-leaked-render.js` (safe): No malicious patterns detected - `lib/rules/jsx-no-literals.js` (safe): No malicious patterns detected; the file is a benign ESLint rule implementation that does not perform any I/O, network, credential, or code-execution activities. - `lib/rules/jsx-no-script-url.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-target-blank.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-undef.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-no-useless-fragment.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-one-expression-per-line.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-pascal-case.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-props-no-multi-spaces.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-props-no-spread-multi.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-props-no-spreading.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-sort-default-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-sort-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-space-before-closing.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-tag-spacing.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-uses-react.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-uses-vars.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/jsx-wrap-multilines.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-access-state-in-setstate.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-adjacent-inline-elements.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-array-index-key.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-arrow-function-lifecycle.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-children-prop.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-danger-with-children.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-danger.js` (safe): No malicious patterns detected - `lib/rules/no-deprecated.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-did-mount-set-state.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-did-update-set-state.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-direct-mutation-state.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-find-dom-node.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-invalid-html-attribute.js` (safe): No malicious patterns detected; the file is a standard ESLint rule implementation for validating HTML 'rel' attributes with no network, filesystem, process, or dynamic code execution concerns. - `lib/rules/no-is-mounted.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-multi-comp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-namespace.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-object-type-as-default-prop.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-redundant-should-component-update.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-render-return-value.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-set-state.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-string-refs.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-this-in-sfc.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-typos.js` (safe): No malicious patterns detected - `lib/rules/no-unescaped-entities.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-unknown-property.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-unsafe.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-unstable-nested-components.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-unused-class-component-methods.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-unused-prop-types.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-unused-state.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/no-will-update-set-state.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/prefer-es6-class.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/prefer-exact-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/prefer-read-only-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/prefer-stateless-function.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/prop-types.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/react-in-jsx-scope.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/require-default-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/require-optimization.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/require-render-return.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/self-closing-comp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/sort-comp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/sort-default-props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/sort-prop-types.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/state-in-constructor.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/static-property-placement.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/style-prop-object.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/rules/void-dom-elements-no-children.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/Components.js` (safe): No malicious patterns detected in this ESLint React component detection utility; it contains only AST analysis logic with no network, filesystem, process, or dynamic execution activity. - `lib/util/annotations.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/ast.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/componentUtil.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/defaultProps.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/docsUrl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/error.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/eslint.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/getTokenBeforeClosingBracket.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/isCreateContext.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/isCreateElement.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/isDestructuredFromPragmaImport.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/isFirstLetterCapitalized.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/jsx.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/lifecycleMethods.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/linkComponents.js` (safe): No malicious patterns detected - `lib/util/log.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/makeNoMethodSetStateRule.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/message.js` (safe): No malicious patterns detected; the code is a benign utility that conditionally returns message data based on ESLint version compatibility. - `lib/util/pragma.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/propTypes.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/propTypesSort.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/propWrapper.js` (safe): No malicious patterns detected - `lib/util/props.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/report.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/usedPropTypes.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/util/variable.js` (safe): Cleared by Jev triage; no further analysis needed AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology