eslint-plugin-security Is Unmaintained. Here's What Nobody Tells You.

Skip to: What It Misses | The Alternative | Migration Guide | OWASP Coverage

TL;DR — Migrate in 60 Seconds

npm uninstall eslint-plugin-security
npm install -D eslint-plugin-secure-coding

That's it. You now have 27 rules instead of 13, with full OWASP Top 10 mapping. Add the full security ecosystem and you get 194 security rules.

Want the full story? Keep reading.

Let's talk about the elephant in the Node.js security room.

eslint-plugin-security is the most-installed ESLint security plugin. It has 1.5M+ weekly downloads. It's recommended by countless tutorials. And it's been effectively unmaintained for years.

This isn't a hit piece—it's a reality check. And a thank you.

eslint-plugin-security pioneered JavaScript security linting. When it launched, it was the only game in town. The maintainers did important work that inspired everything that came after.

But the threat landscape has changed. Let's see where we are in 2026.

The Numbers Don't Lie

The plugin was groundbreaking when it launched. But the JavaScript security landscape has changed dramatically since 2020.

Is eslint-plugin-security Still Maintained?

Let's look at the actual repository:

Note: The plugin was transferred to eslint-community in 2023, which extended its life. But activity remains minimal, and the rule set hasn't grown.

What Does eslint-plugin-security Miss?

Let's be specific. Here are vulnerability categories the plugin cannot detect:

1. Modern SQL Injection Patterns

// ❌ NOT detected by eslint-plugin-security
const query = `SELECT * FROM users WHERE email = '${userInput}'`;
await pool.query(query);

The plugin has no PostgreSQL-aware rules. No understanding of parameterized queries. No detection of string concatenation in database contexts.

Detection: eslint-plugin-pg catches this with pg/no-unsafe-query.

2. AI/LLM Vulnerabilities

// ❌ NOT detected by eslint-plugin-security
import { generateText } from "ai";

const response = await generateText({
  model: openai("gpt-4"),
  prompt: userInput, // Prompt injection - no system prompt protection
});

AI security didn't exist when the plugin was written. There are zero rules for prompt injection, system prompt leakage, or tool abuse.

Detection: eslint-plugin-vercel-ai-security provides 19 rules for Vercel AI SDK patterns.

3. JWT Security Issues

// ❌ NOT detected by eslint-plugin-security
jwt.verify(token, secret, { algorithms: ["none"] }); // Algorithm confusion attack

JWT attacks are some of the most common vulnerabilities in Node.js applications. The plugin has no JWT-specific rules.

Detection: eslint-plugin-jwt catches algorithm confusion, missing expiration, and weak secrets.

4. Connection Leaks

// ❌ NOT detected by eslint-plugin-security
async function getUser(id) {
  const client = await pool.connect();
  return client.query("SELECT * FROM users WHERE id = $1", [id]);
  // client.release() never called - connection leak
}

Production outages from connection exhaustion are common. No detection.

Detection: pg/no-missing-client-release ensures every connect() has a matching release().

5. Path Traversal with Modern APIs

// ❌ NOT detected by eslint-plugin-security
import { readFile } from "node:fs/promises";
const content = await readFile(`./uploads/${filename}`);

The plugin's path traversal detection is limited to older fs patterns.

Detection: node-security/detect-non-literal-fs-filename understands modern node:fs/promises imports and validates path safety.

The 13 Rules, Reviewed

Let's look at what eslint-plugin-security actually provides:

Verdict: ~4 rules are still fully relevant. ~5 are partially useful. ~4 are obsolete.

Why This Matters

If you're using eslint-plugin-security as your primary security linting:

1. You're missing ~90% of detectable vulnerabilities
2. You have no OWASP Top 10 coverage map for compliance
3. You have no AI/LLM protection as your team adopts AI tools
4. You're running on 2020-era detection in a 2026 threat landscape

What Should I Use Instead of eslint-plugin-security?

The modern approach is domain-specific security plugins that understand context. Think of it as a layered security architecture:

The Security Ecosystem: 10 Plugins, 194 Rules

Quick Start: Choose Your Stack

Node.js Backend (Express/Fastify):

npm install -D eslint-plugin-secure-coding \
              eslint-plugin-node-security \
              eslint-plugin-express-security \
              eslint-plugin-pg \
              eslint-plugin-jwt

Serverless (AWS Lambda):

npm install -D eslint-plugin-secure-coding \
              eslint-plugin-lambda-security \
              eslint-plugin-pg

MongoDB/Mongoose Backend:

npm install -D eslint-plugin-secure-coding \
              eslint-plugin-mongodb-security \
              eslint-plugin-node-security \
              eslint-plugin-jwt

AI/LLM Applications:

npm install -D eslint-plugin-secure-coding \
              eslint-plugin-vercel-ai-security \
              eslint-plugin-node-security

Browser/Frontend:

npm install -D eslint-plugin-secure-coding \
              eslint-plugin-browser-security

Does This Support ESLint 9 Flat Config?

Yes. All 10 security plugins are built for the modern ESLint ecosystem with native flat config support:

// eslint.config.js - Full security suite
import secureCoding from "eslint-plugin-secure-coding";
import nodeSecurity from "eslint-plugin-node-security";
import express from "eslint-plugin-express-security";
import pg from "eslint-plugin-pg";
import jwt from "eslint-plugin-jwt";

export default [
  secureCoding.configs.recommended,
  nodeSecurity.configs.recommended,
  express.configs.recommended,
  pg.configs.recommended,
  jwt.configs.recommended,
];

Rule-by-Rule Migration

Every eslint-plugin-security rule has a modern replacement:

But that's just the migration. The real value is the 181 additional security rules you gain:

OWASP Top 10 Coverage

The ultimate test of a security plugin is OWASP coverage:

*A06 (Vulnerable Components) requires Software Composition Analysis (SCA) tools like npm audit, Snyk, or Socket—not static analysis. ESLint can't detect outdated dependencies.

Total coverage: eslint-plugin-security ~20% | Interlace ~100%

Ready to Upgrade?

Option 1: Quick Migration (60 seconds)

npm uninstall eslint-plugin-security
npm install -D eslint-plugin-secure-coding
npx eslint . --max-warnings 0

Option 2: Full Security Suite (5 minutes)

npm install -D eslint-plugin-secure-coding eslint-plugin-pg \
              eslint-plugin-jwt eslint-plugin-node-security

Option 3: See What You're Missing First

Run ESLint with the new plugins on your codebase. You'll likely find vulnerabilities that were invisible before.

npx eslint . --format stylish

A Note on Open Source Maintenance

Maintaining open-source projects is hard, often thankless work. The eslint-plugin-security maintainers gave the community years of value. This article isn't criticism—it's recognition that the community has evolved, and our tools should too.

If you use and benefit from open-source security tooling, consider sponsoring maintainers who keep the ecosystem alive.

The Bottom Line

eslint-plugin-security was important. It pioneered JavaScript security linting. But we owe it to our codebases to use tools that match today's threat landscape.

13 rules from 2020 aren't enough for 2026.

Explore the Full Ecosystem

194 security rules. 10 specialized plugins. 100% OWASP Top 10 coverage.

The Interlace ESLint Ecosystem provides comprehensive security static analysis for modern Node.js applications.

📖 Documentation | ⭐ GitHub | 📦 NPM

Related Articles:

• Getting Started with eslint-plugin-secure-coding
• SQL Injection in Node.js: The Pattern 80% Get Wrong
• The JWT Algorithm 'None' Attack
• Mapping Your Codebase to OWASP Top 10
• The 30-Minute Security Audit

Build Securely.

I'm Ofri Peretz, a Security Engineering Leader and the architect of the Interlace Ecosystem. I build static analysis standards that automate security and performance for Node.js fleets at scale.

ofriperetz.dev | LinkedIn | GitHub