JSPM

Cryptographic security rules enforcing best practices and modern standards (Node.js crypto).

Description

This plugin provides Cryptographic security rules enforcing best practices and modern standards (Node.js crypto). By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.

Philosophy

Interlace fosters strength through integration. Instead of stacking isolated rules, we interlace security directly into your workflow to create a resilient fabric of code. We believe tools should guide rather than gatekeep, providing educational feedback that strengthens the developer with every interaction.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚
• 要查看中文 指南, 请访问 eslint.interlace.tools. 📚
• 가이드 문서는 eslint.interlace.tools에서 확인하실 수 있습니다. 📚
• ガイドは eslint.interlace.toolsでご確認ください。 📚
• Para ver la guía, visita eslint.interlace.tools. 📚
• للاطلاع على الدليل، قم بزيارة eslint.interlace.tools. 📚

npm install eslint-plugin-crypto --save-dev

💡 What You Get

• 24 security rules covering cryptographic best practices
• CVE detection for CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
• OWASP Top 10 coverage for cryptographic vulnerabilities
• LLM-optimized messages with CWE references and fix guidance
• Package support for crypto-hash, crypto-random-string, crypto-js

Features

• 🔐 24 Rules covering crypto best practices
• 🎯 CVE Detection (CVE-2023-46809, CVE-2020-36732, CVE-2023-46233)
• 🤖 AI-Optimized messages with CWE references
• ⚡ Auto-Fix suggestions where safe
• 📦 Package Support for crypto-hash, crypto-random-string, crypto-js

⚙️ Configuration Presets

📚 Supported Libraries

Library	npm	Downloads	Detection
crypto (Node.js)		-	Weak Algo, Key Length, Randomness
crypto-js			Legacy patterns, Weak PRNG

Examples

❌ Bad

// CVE-2023-46809: Marvin Attack
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_PADDING }, buffer);

// CWE-338: Weak random
const token = Math.random().toString(36);

// CWE-327: ECB mode leaks patterns
crypto.createCipheriv('aes-256-ecb', key, iv);

// CWE-208: Timing attack
if (userToken === storedToken) { ... }

✅ Good

// Use OAEP padding
crypto.privateDecrypt({ key, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }, buffer);

// Secure random
const token = crypto.randomBytes(32).toString('hex');

// GCM provides authentication
crypto.createCipheriv('aes-256-gcm', key, iv);

// Constant-time comparison
if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) { ... }

Peer Dependencies (Optional)

{
  "crypto-hash": ">=3.0.0",
  "crypto-random-string": ">=4.0.0",
  "crypto-js": ">=4.0.0"
}

Rules

Legend

🔗 Related ESLint Plugins

Part of the Interlace ESLint Ecosystem — AI-native security plugins with LLM-optimized error messages:

Plugin	Downloads	Description
eslint-plugin-secure-coding		General security rules & OWASP guidelines.
eslint-plugin-pg		PostgreSQL security & best practices.
eslint-plugin-crypto		NodeJS Cryptography security rules.
eslint-plugin-jwt		JWT security & best practices.
eslint-plugin-browser-security		Browser-specific security & XSS prevention.
eslint-plugin-express-security		Express.js security hardening rules.
eslint-plugin-lambda-security		AWS Lambda security best practices.
eslint-plugin-nestjs-security		NestJS security rules & patterns.
eslint-plugin-mongodb-security		MongoDB security best practices.
eslint-plugin-vercel-ai-security		Vercel AI SDK security hardening.
eslint-plugin-import-next		Next-gen import sorting & architecture.

📄 License

MIT © Ofri Peretz