eslint-plugin-crypto

🔐 Security-focused ESLint plugin for cryptographic best practices. Detects weak algorithms, insecure key handling, CVE vulnerabilities, and guides you to modern, secure alternatives.

💡 What You Get

• 24 security rules covering cryptographic best practices
• CVE detection for CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
• OWASP Top 10 coverage for cryptographic vulnerabilities
• LLM-optimized messages with CWE references and fix guidance
• Package support for crypto-hash, crypto-random-string, crypto-js

Features

• 🔐 24 Rules covering crypto best practices
• 🎯 CVE Detection (CVE-2023-46809, CVE-2020-36732, CVE-2023-46233)
• 🤖 AI-Optimized messages with CWE references
• ⚡ Auto-Fix suggestions where safe
• 📦 Package Support for crypto-hash, crypto-random-string, crypto-js

Installation

npm install eslint-plugin-crypto --save-dev

🚀 Quick Start

ESLint Flat Config (eslint.config.js)

import crypto from 'eslint-plugin-crypto';

export default [crypto.configs.recommended];

Presets

Rule Categories

Core Node.js Crypto (8 rules)

CVE-Specific Rules (3 rules)

Advanced Security (7 rules)

Package-Specific Rules (6 rules)

Examples

❌ Bad

// CVE-2023-46809: Marvin Attack
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_PADDING }, buffer);

// CWE-338: Weak random
const token = Math.random().toString(36);

// CWE-327: ECB mode leaks patterns
crypto.createCipheriv('aes-256-ecb', key, iv);

// CWE-208: Timing attack
if (userToken === storedToken) { ... }

✅ Good

// Use OAEP padding
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }, buffer);

// Secure random
const token = crypto.randomBytes(32).toString('hex');

// GCM provides authentication
crypto.createCipheriv('aes-256-gcm', key, iv);

// Constant-time comparison
if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) { ... }

Peer Dependencies (Optional)

{
  "crypto-hash": ">=3.0.0",
  "crypto-random-string": ">=4.0.0",
  "crypto-js": ">=4.0.0"
}

AI-Optimized Messages

All rules include LLM-optimized error messages with:

• CWE references for vulnerability classification
• CVE references for known vulnerabilities
• Severity levels (CRITICAL, HIGH, MEDIUM, LOW)
• Direct fix suggestions with code examples
• Documentation links

🗂️ OWASP Top 10 2021 Coverage

🔗 Related ESLint Plugins

Part of the Forge-JS ESLint Ecosystem — AI-native security plugins with LLM-optimized error messages:

License

MIT © Ofri Peretz