eslint-plugin-crypto

🔐 Security-focused ESLint plugin for cryptographic best practices. Detects weak algorithms, insecure key handling, CVE vulnerabilities, and guides you to modern, secure alternatives.

💡 What You Get

• 24 security rules covering cryptographic best practices
• CVE detection for CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
• OWASP Top 10 coverage for cryptographic vulnerabilities
• LLM-optimized messages with CWE references and fix guidance
• Package support for crypto-hash, crypto-random-string, crypto-js

Features

• 🔐 24 Rules covering crypto best practices
• 🎯 CVE Detection (CVE-2023-46809, CVE-2020-36732, CVE-2023-46233)
• 🤖 AI-Optimized messages with CWE references
• ⚡ Auto-Fix suggestions where safe
• 📦 Package Support for crypto-hash, crypto-random-string, crypto-js

Installation

npm install eslint-plugin-crypto --save-dev

🚀 Quick Start

ESLint Flat Config (eslint.config.js)

import crypto from 'eslint-plugin-crypto';

export default [crypto.configs.recommended];

Presets

🔐 Rules

💼 = Set in recommended | 🔧 = Auto-fixable | 💡 = Has suggestions

Core Node.js Crypto (8 rules)

CVE-Specific Rules (3 rules)

Advanced Security (7 rules)

Package-Specific Rules (6 rules)

Examples

❌ Bad

// CVE-2023-46809: Marvin Attack
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_PADDING }, buffer);

// CWE-338: Weak random
const token = Math.random().toString(36);

// CWE-327: ECB mode leaks patterns
crypto.createCipheriv('aes-256-ecb', key, iv);

// CWE-208: Timing attack
if (userToken === storedToken) { ... }

✅ Good

// Use OAEP padding
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }, buffer);

// Secure random
const token = crypto.randomBytes(32).toString('hex');

// GCM provides authentication
crypto.createCipheriv('aes-256-gcm', key, iv);

// Constant-time comparison
if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) { ... }

Peer Dependencies (Optional)

{
  "crypto-hash": ">=3.0.0",
  "crypto-random-string": ">=4.0.0",
  "crypto-js": ">=4.0.0"
}

AI-Optimized Messages

All rules include LLM-optimized error messages with:

• CWE references for vulnerability classification
• CVE references for known vulnerabilities
• Severity levels (CRITICAL, HIGH, MEDIUM, LOW)
• Direct fix suggestions with code examples
• Documentation links

🗂️ OWASP Top 10 2021 Coverage

🔗 Related ESLint Plugins

Part of the Interlace ESLint Ecosystem — AI-native security plugins with LLM-optimized error messages:

Plugin	Downloads	Description	Rules
eslint-plugin-secure-coding		Universal security (OWASP Top 10 Web + Mobile)	89
eslint-plugin-jwt		JWT security (algorithm confusion, weak secrets, claims)	13
eslint-plugin-pg		PostgreSQL/node-postgres security	13
eslint-plugin-express-security		Express.js security (CORS, cookies, CSRF, helmet)	8
eslint-plugin-nestjs-security		NestJS security (guards, validation pipes, throttler)	5
eslint-plugin-lambda-security		AWS Lambda/Middy security (API Gateway, CORS, secrets)	5
eslint-plugin-browser-security		Browser security (XSS, postMessage, storage, cookies)	21
eslint-plugin-vercel-ai-security		Vercel AI SDK security (OWASP LLM + Agentic Top 10)	19
eslint-plugin-import-next		High-performance import linting	12

License

MIT © Ofri Peretz